Owner/group permissions are different than the .htaccess directory protection we have been talking about. Here is a good page the will explain .htaccess protection:
http://www.javascriptkit.com/howto/htaccess3.shtml
Sorry I missed C. above. I didn't see if for some reason. When I set up my test board, I make a copy of my database and copy it into a new database (like test_db) and copy all my attachment, avatar, torrent files and move them all over to my test directory. So, now I have all the information from my real site over on my test site. Then I upload the new php files from vbulletin and run the upgrade script. Then I install all the mods I need. I actually also have a little notebook that I keep notes in with the names of all templates I modify and all php pages I modify and a little note of why "mod to remove torrent", "mod to add spider count", etc. It's not a perfect method, but it helps me out a lot. I don't like having the site down for long, so if I have everything all neatly in order, I can upgrade my site a lot quicker. I recently upgraded from 3.0.12 to 3.6.8 and I only had the site down for less than two hours and that's due to all the preparation I did on my test site to get ready for that upgrade. I had some custom mods that aren't all plug-and-play, so that was pretty good timing for me!
As for you hardcoded links, you might want to take a look at them and see if they need to be. My navbar isn't standard vb because I have pages 'outside' my forums folder, so I actually 'hardcode' the link, but I do that by just putting "$vboptions[bburl]/" in front of all the links. It gets that variable from the vboptions. So, as long as it is correct in there, then I am fine. There are some threads with hardcoded links, but those don't affect my testing.