I am running nginx, which I understand runs under the www-data user account.

All my wordpress related files are currently set to root root, is this normal? Or should they be set the www-data account (and group?)


I think they should be chowned to www-data:www-data. This is somewhat more secure, because if your site gets compromised, and you had a file that was owned as root, and had the executable permissions, it would be a hell of a lot easier to run a command as root, than if all the files and directories were owned by a non-privileged user.

As long as nginx runs as www-data, you shouldn't have any trouble having the files owned by the same user

  • If an executable or script is owned by root does not means that it will run as root. As an example all system binaries are owned by root, still, you run them as your user. The only exception are the SUID binaries. – Mircea Vutcovici Nov 29 '10 at 21:02
  • If it doesn't need to be owned by root, it shouldn't be. Simples! </meerkat> – Tom O'Connor Nov 29 '10 at 23:50

a issue you may face is automatically installing plugins in the WordPress admin will require you to login via FTP/SFTP if the files aren't owned by www-data.

  • so its a win win scenerio if I change it to www-data then, both security and plugin installation wise? – Blankman Nov 28 '10 at 2:50
  • Nope. It is not secure. If the application has a flaw, then a remote user can write any php and then run any command as www-data. – Mircea Vutcovici Nov 29 '10 at 2:28

For best security I wold use a different user than www-data, except for the folders that I want to be writable by the application (like image upload folder). This user can be root, but it is better, if you are not the programmer, to be owned by a generic application user like wordpress.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.