security+best practices: root or www-data on a wordpress content folder?

    drwxr-xr-x  8 www-data www-data
    drwxr-xr-x  6 www-data www-data
    -rw-r--r--  1 www-data www-data
    -rw-r--r--  1 www-data www-data
    -rw-r--r--  1 www-data www-data
    drwxr-xr-x  7 www-data www-data
    drwxr-xr-x  7 root     root    

This is on a wordpress install on an AWS linux server and that “root” owned folder is where all my changes go. To write my changes to that directory I had to sudo them in, that left ownership as “root” whereas every other folder is the defacto “www-data” user group.

Is this bad? Why?

I fixed this by running this command:

    cd /var/www/html/
    sudo chown -Rv www-data:www-data *

Changed ownership back to www-data instead of root. This article helped me:

http://johnqunknown.me/fixing-wordpress-a-mini-tutorial/