WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It only takes a minute to sign up.
Sign up to join this community
I am not server or security expert so please excuse if my question sounds odd.
I am running wordpress site on ubuntu 14.04 with nginx server. I had a problem while installing new plugin, So I have changed all my wordpress directory permission from my server user to www-data and it started working fine.
My question here is : Is it safe to give wordpress directories ownership to www-data user? If not please suggest alternatives.
Thanks in advance.
No, it is not safe as it means that any security breach might end up in your code being changed.
Alternatives:
There is nothing wrong in using SFTP to upload changed plugins. If it is something that might take long time, you can manually put wordpress into maintenance mode by adding a file named .maintenance at the wordpress root directory and removing it after that (For core upgrades I just upload to different directories and then rename them).
You can set up an FTP server which is blocked from the outside world but can accept traffic from localhost, and configure a user in it that will have permission to write to your wordpress directories, and use this user credentials when upgrading/installing.
