Definitive wordpress directory ownership and permissions on linux

If your aim is security, the only directory writable by the web server should be uploads. Yes, it means no easy updates, but in a secure environment the web server should not be able to write to directories in which there is executable code.

If you have so many updates that SFTP becomes too much of a time waster, install and use the wp-cli utility to do updates.

…. Almost forgot, the way to have updates while avoiding the permissions confusion is to run and FTP server that will be limited to accept requests from the local host. Firewall the FTP ports from any other host and you got both the possibility to update from the browser while being secure.