I have a a script to automatically backup my WordPress database and files, and another to restore them over FTP. I'm setting up the FTP server and trying to decide which user to allow FTP access. I know I shouldn't use root over FTP, but is it appropriate to use www-data (the owner of those files)?


  • If at all possible, use SCP/SFTP instead of FTP. – danlefree Nov 28 '10 at 5:45

From a security standpoint, it's almost never a good idea to make it possible for a system user (like www-data) to login remotely.

Instead, create a new user specifically to own your Wordpress files. Make www-data the primary group for your user, so that all files you create will be group-owned by the www-data group. As long as your umask is not too restrictive, any files you create as this user should be readable by the www-data group, and thus also visible to the web server.

Finally, I would recommend against using FTP (for a couple of reasons, security being biggest), and instead use SFTP, SCP, or rsync-over-ssh.


Create a user specifically for your backup jobs, then add that user to the www-data group. Then ensure that the www-data group has read access to the necessary files.

  • Thanks for your answer. What's the benefit of creating a separate user for backups? I'd also need write access to perform automatic restore. – yayitswei Nov 28 '10 at 2:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.