I know there are a thousand questions about this all over the place and trust me I've been trying every possible solution for years [not an overstatement] and each and every one is either missing a crucial piece or simply doesn't work [in my experience].

I'm looking for a solid, complete, and open minded solution for the wordpress directory user / group ownership and permissions on linux. The requirements are the ones that I think everyone should be looking for: state of the art security, auto-updates, and sftp access.

The facts - if I'm not missing anything - are fairly straightforward: if we configure ownership of the web directory [in my case /var/www/] to a dedicated user [meaning not the webserver user - which in my case is www-data], as in: wp:www-data, wordpress is able to install themes and plugins but not to auto-update itself [security issue], even with fs method: direct;

if we attribute everything to www-data, as in www-data:www-data, files are owned by the webserver user [security issue];

and to access everything through sftp, even if we setup chroot, bind mounts, and access with a dedicated sftp user with whatever comination of user / group nesting [sftp being a part of www-data, sftp and www-data being a part of the same group, and so on...], files uploaded via sftp are created as the sftp user and even with the most complex ACL rules and excluding periodic chown / chmod scripts [which are absurd] ownership and permissions are always wrong.

I am astonished I haven't found a more obvious solution up until now. How many insecurely configured web servers are there out there? I'm sure the solution is out there and that you guys can help me figure this out. Thank you so much in advance! :)

  • I hope that after 6 years that have passed since this post you have been able to find the light with this topic. I am currently struggling with the same thing, I hope that the current versions and technologies have provided a solution according to this problem of permissions and users. were you able to find a solution to this wordpress server scenario? Commented May 4, 2022 at 12:20
  • This does not provide an answer to the question. Once you have sufficient reputation you will be able to comment on any post; instead, provide answers that don't require clarification from the asker. - From Review
    – bosco
    Commented May 4, 2022 at 15:24

1 Answer 1


If your aim is security, the only directory writable by the web server should be uploads. Yes, it means no easy updates, but in a secure environment the web server should not be able to write to directories in which there is executable code.

If you have so many updates that SFTP becomes too much of a time waster, install and use the wp-cli utility to do updates.

.... Almost forgot, the way to have updates while avoiding the permissions confusion is to run and FTP server that will be limited to accept requests from the local host. Firewall the FTP ports from any other host and you got both the possibility to update from the browser while being secure.

  • Ok thanks I'll look into wp-cli. Any idea for the rest of the issues?
    – Nikksno
    Commented Nov 8, 2016 at 10:18
  • @Nikksno, maybe I missed something, but once you limit the webserver to upload there are no other issues as all of the other directories belong to the user Commented Nov 8, 2016 at 11:06
  • @Nikksno, added another option Commented Nov 8, 2016 at 13:56
  • Ok so [s]ftp updates could be an option. I was wondering how to deal with the sftp issue: ownership / permissions, and so on. Is there a way to make both wp updates and user sftp access work with my requirements? Thank you.
    – Nikksno
    Commented Nov 10, 2016 at 9:27
  • @Nikksno, if you use the ftp option, you can use the same user as you use with SFTP, so at least there should not be any confusion from that - just one user for all Commented Nov 10, 2016 at 16:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.