drwxr-xr-x  8 www-data www-data
    drwxr-xr-x  6 www-data www-data
    -rw-r--r--  1 www-data www-data
    -rw-r--r--  1 www-data www-data
    -rw-r--r--  1 www-data www-data
    drwxr-xr-x  7 www-data www-data
    drwxr-xr-x  7 root     root    

This is on a wordpress install on an AWS linux server and that "root" owned folder is where all my changes go. To write my changes to that directory I had to sudo them in, that left ownership as "root" whereas every other folder is the defacto "www-data" user group.

Is this bad? Why?

  • It's bad. It's well documented. If a script in there has a vulnerability then whatever your hacker wants will run as the file owner, root, allowing them to do anything. Commented Oct 2, 2016 at 20:35

1 Answer 1


I fixed this by running this command:

    cd /var/www/html/
    sudo chown -Rv www-data:www-data *

Changed ownership back to www-data instead of root. This article helped me:


  • Glad you were able to solve your own question, be sure to click the checkmark next to your answer after two days to indicate that this question is resolved. Commented Oct 2, 2016 at 22:39
  • Not secure - you should not give ownership to the same user running apache. wordpress.org/support/article/hardening-wordpress
    – DropHit
    Commented Aug 17, 2019 at 19:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.