Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running nginx, which I understand runs under the www-data user account.

All my wordpress related files are currently set to root root, is this normal? Or should they be set the www-data account (and group?)

share|improve this question
up vote 1 down vote accepted

I think they should be chowned to www-data:www-data. This is somewhat more secure, because if your site gets compromised, and you had a file that was owned as root, and had the executable permissions, it would be a hell of a lot easier to run a command as root, than if all the files and directories were owned by a non-privileged user.

As long as nginx runs as www-data, you shouldn't have any trouble having the files owned by the same user

share|improve this answer
If an executable or script is owned by root does not means that it will run as root. As an example all system binaries are owned by root, still, you run them as your user. The only exception are the SUID binaries. – Mircea Vutcovici Nov 29 '10 at 21:02
If it doesn't need to be owned by root, it shouldn't be. Simples! </meerkat> – Tom O'Connor Nov 29 '10 at 23:50

a issue you may face is automatically installing plugins in the WordPress admin will require you to login via FTP/SFTP if the files aren't owned by www-data.

share|improve this answer
so its a win win scenerio if I change it to www-data then, both security and plugin installation wise? – Blankman Nov 28 '10 at 2:50
Nope. It is not secure. If the application has a flaw, then a remote user can write any php and then run any command as www-data. – Mircea Vutcovici Nov 29 '10 at 2:28

For best security I wold use a different user than www-data, except for the folders that I want to be writable by the application (like image upload folder). This user can be root, but it is better, if you are not the programmer, to be owned by a generic application user like wordpress.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.