Correct permissions for WordPress directories and files on Ubuntu 20.04 with Apache

Question

My client's website is hosted at Digital Ocean and is running Ubuntu 20.04 with Apache. I have WordPress installed and running with some issues. The ability to upload or update plugins and themes is not working because of permission issues. I have been following the official WordPress security hardening article, but I believe some of the changes I have applied have caused the permission issues.

I have detailed all of the current permission settings below for reference. The user for this account is callkneehill.

Root WordPress directory (callkneehill.ca) and files found in /var/www:

• 755
• 644
• Owner and group are callkneehill

wp-admin and wp-include directories and files (recursively applied):

• 755
• 644
• Owner and group are callkneehill

wp-content directories and files (recursively applied):

• 755
• 644
• Owner is callkneehill
• Group is www-data

plugins and theme directories and files (recursively applied):

• 755
• 644
• Owner and group is callkneehill

With these permissions, WordPress informs me that FTP/SFTP needs to be used to upload/update plugins and themes. Before working with the hardening article, www-data was the sole owner and group for permissions within the WordPress root directory.

If I use www-data on the plugins and themes directory, the same FTP/SFTP notice is displayed when trying to upload or update.

How do I go about configuring the user and group permissions to provide the security hardening with the ability to upload/update within WordPress?

Updated with per-user pool configuration settings

Should chdir be /var/www/callkneehill.ca?

/etc/php/7.4/fpm/pool.d

[callkneehill]
user = callkneehill
group = callkneehill

listen = /run/php/callkneehill.sock
chdir = /var/www

listen.owner = www-data
listen.group = www-data

/etc/apache2/sites-available

<FilesMatch \.php$>
   # SetHandler "proxy:unix:/var/run/php/php7.4-fpm.sock|fcgi://localhost"
   SetHandler "proxy:unix:/run/php/callkneehill.sock|fcgi://localhost"
</FilesMatch>

Answer 1

The core problem might not be the file permissions, but that you are running PHP as www-data instead of running a PHP-FPM pool as user callkneehill. When you run the scripts as the same user that owns them, you don't need this kind of hacks. On a multi-user system this is also essential as it prevents the users from modifying the sites of other users.

There are several tutorials for installing PHP-FPM on Ubuntu 20.04, so there is no need to repeat the instructions here. Therefore, I only give an example on the per-user pool in /etc/php/7.4/fpm/pool.d/callkneehill.conf:

[callkneehill]
user = callkneehill
group = callkneehill

listen = /run/php/callkneehill.sock
chdir = /var/www

listen.owner = www-data
listen.group = www-data

Using the pool from Apache VirtualHost configuration is done by adding a handler that uses the UNIX socket:

<FilesMatch \.php$> 
    SetHandler "proxy:unix:/run/php/callkneehill.sock|fcgi://localhost"
</FilesMatch>