Running WordPress as FTP user?

Your files should be owned by your account. Period. They should not be owned by the “apache” user. This is insecure.

The files may need to be readable by the apache user. The recommended permissions are 755 for folders and 644 for files. With the exception of the wp-config.php file, which should be set to the lowest permissions that work. This would be 640, usually.

The wp-content folder and the uploads folder may need more permissive permissions for media uploads to work.

If the webserver is running as a different user, then WordPress will detect this, and when you try to do an upgrade, it will ask for your FTP information. Then it will do the update via FTP. By getting your information, it can log in as you and thus upload your files.

If you don’t have FTP enabled on your server, you can configure WordPress to use SSH methods instead. This is a bit more complex and not common.

If the webserver is running as a different user, but using a “setuid” method, then it will automatically run the PHP files under your user account instead, and then it will be able to update directly. This is because a setuid method will change the process run as the userid of the files. This is more common on shared hosting, because it is more secure in such cases.

Some setuid methods that are used are “mod_suphp” or “FastCGI with suexec”.

Regardless, you need to own your files, not the webserver.