Is it safe to give wordpress directories ownership to www-data?

No, it is not safe as it means that any security breach might end up in your code being changed.

Alternatives:

  1. There is nothing wrong in using SFTP to upload changed plugins. If it is something that might take long time, you can manually put wordpress into maintenance mode by adding a file named .maintenance at the wordpress root directory and removing it after that (For core upgrades I just upload to different directories and then rename them).

  2. You can set up an FTP server which is blocked from the outside world but can accept traffic from localhost, and configure a user in it that will have permission to write to your wordpress directories, and use this user credentials when upgrading/installing.

Related Posts:

  1. On new server, site got hacked, permissions a bit strange? Please help
  2. Security: Critical backend outside of wordpress
  3. Why are the latest visits to my website originating from my own website?
  4. Folder Permissions + Security Concerns
  5. How to rewrite rules for WP-security in Nginx?
  6. nginx + wordpress: Best practices for configuring it to be secure, reliable, and fast? [closed]
  7. How can I give someone server access to only duplicate and modify a site?
  8. What is the difference between a cer, pvk, and pfx file?
  9. How to solve “Kernel panic – not syncing – Attempted to kill init” — without erasing any user data
  10. Is it possible to decrypt SHA1
  11. Error `sec_error_revoked_certificate` when viewed in Firefox only
  12. Convert .pfx to .cer
  13. Why should I use the esc_url?
  14. Where to securely store API keys and passwords in WordPress?
  15. Why escape if the_content isnt?
  16. Full path disclosure on rss-functions.php
  17. What to use instead of wp_kses() in user output
  18. Are the default salts secure?
  19. is_email() VS sanitize_email()
  20. Subscribe to email for security fixes?
  21. How to escape custom css?
  22. Understanding SVG vulnerabilities in WordPress related to a specific fix
  23. Moving wp-config.php: Can this be done after site launch?
  24. How to secure or disable the RSS feeds?
  25. Make password invalid once logged out of password-protected page
  26. How to get WordPress to save upload file beyond web root [closed]
  27. Is security a problem in WordPress?
  28. Moving wordpress out of the public directory
  29. WordPress salts set in config and database
  30. Logout via Subdomain, non-wordpress page on a different server?
  31. Protecting HTML5 video [closed]
  32. How can I tell who changed the password?
  33. WordPress website Security [closed]
  34. Do I need to use the esc_html() function on hard coded links?
  35. Can’t reset WordPress password
  36. Is the “lost password” feature truly a vulnerability?
  37. Frontend Password change
  38. Is it possible to reduce the minimum character length for passwords?
  39. Handling email piping attachments and detecting unsupported file types
  40. Downloading File from Outside Web Root
  41. site get login attempts after htaccess ip restriction
  42. Is it good security advice to install wordpress in subdirectory but link to root?
  43. Why was my blog post inserted lot’s of ad links by others?
  44. Moving wp-config.php up 2 levels
  45. How Could I sanitize the receive data from this code
  46. WordPress SQL Injections through User Agent
  47. Should I Worry About SQL Injection When Using wp_insert_post?
  48. Is there a way for a user to have an alias?
  49. How to prevent wp-login brute force attack from thousand of different IP? [duplicate]
  50. Evaluations of two wordpress security plans against php code injection attack
  51. What permissions should I give directories if I want to make WordPress more secure?
  52. Security threat with `home_url`?
  53. When is wp_set_password() called or how to capture a password
  54. How to protect wp-admin through .htaccess?
  55. Something is unescaping all html entities before output to browser [closed]
  56. Frequently getting attacks on admin-ajax.php, wp-cron.php, xmlrpc.php and wp-login.php
  57. How to get WordPress to send Password Reset Link Email instead of New Password?
  58. Verifying that I have fully removed a WordPress hack?
  59. Large Session Tokens
  60. How to change permissions of WordPress and/or apache on macOS securely?
  61. Using an Encryption class in a WordPress Plugin
  62. Limit Login Attempts BEFORE PHP is executed?
  63. Safe to say WordPress security releases don’t have database upgrades
  64. Config file with no Keys..?
  65. How much should I worry about these messages?
  66. Security concerns with external links
  67. Uploading .webm format on WordPress results in security guidline breach and fail
  68. fail2ban to prevent Brute Force Attacks on WordPress?
  69. Use Google authentication for pages within a website [closed]
  70. How to give the same error message when the wrong password or wrong username is used?
  71. should I escape a literal url added in functions.php
  72. Moving wp-config.php outside root folder where we have multiple wordpress websites for enhanced security [duplicate]
  73. Adding Security Keys?
  74. How might I sanitize an XML file before WP Import? (Does wordpress verify or clean text when importing from an XML document? )
  75. Secret keys in SCM
  76. Ubuntu 12.04, Nginx and MySQL issue with WordPress Database
  77. Secure Server after configuration
  78. Uploading attachment (pdf) and prevent download for anonymous user
  79. After limiting the access to my wp-login.php by IP through .htaccess, all my password-protected posts stopped working. What’s the best solution now?
  80. Specific Page/Post Need to Stay Non SSL
  81. Block JSON access over the net
  82. Can someone do something to my website if I posted a snapped image of the header and covered my logo? (On reddit, when explaining a question)
  83. Scan multiple websites for malware that are in same webhost root?
  84. The in-famous Unable to locate WordPress Content directory (wp-content) and the Direct Method
  85. Security: AWS (shared hosting) claims template file malicious
  86. How to check whether a site has been compromised without browsing into it?
  87. My site thinks it’s secure when it is fact not
  88. Is it possible to only have the admin interface bind to the local loopback?
  89. PHP Code Sniffer – WordPress VIP Coding Standards
  90. Trying to understand nature of hacking
  91. Default installation permissions for wp-config.php
  92. Correct setup to block file modifications from hackers
  93. Is my WP site being hacked?
  94. checking the form submit in right order
  95. Our security auditor is an idiot. How do I give him the information he wants?
  96. I am under DDoS. What can I do?
  97. SSH keypair generation: RSA or DSA?
  98. How do I protect my company from my IT guy? [closed]
  99. Does changing default port number actually increase security? [closed]
  100. WordPress – tracking options