I had to also change the owner of the root web directory.
chown apache:apache . # or chown apache:apache /var/www/html
Edit by Otto: Chloe, as you asked for more information than I could reasonably put into a comment, I’m appending this on to your answer. I hope that is okay. If not, feel free to revert it, or let me know and I will do so.
The reason that I commented about this being a security issue has to do with file ownership and restricting permissions and limiting access.
Unix like systems contain the concept of “owners” and “permissions”. Files are owned by some user account, and have permissions that control whether they are read, write, or executable by other accounts. This is inherently a security feature, to prevent other accounts from being able to write to your files, or perhaps to allow them to do so.
Running programs also have “owners”. Those programs inherit the permission capabilities of their owner. If you run a program, it can do anything you can do, but will be prevented from doing anything that you can not, because it is “owned” by your user account.
When it comes to web servers, you’re essentially allowing the outside world to run a program on your computer. Because of this, ownership is important, and so most web servers run as a “www” user, or in the common case of the Apache web server, as the “apache” user.
If somebody is able to hack their way in through some program running on your website, then they will gain control over that program, but will still be limited by the capabilities of that program. If they hack a process run by “apache”, then their user will be “apache” and they will only have access as the “apache” user account.
Thus, having your files owned by “apache” is a security issue, because you’re essentially saying that anybody in the world is the owner of these files. Anybody who happens to get in through that door can see them, edit them, modify them.
On the other hand, if the user account that owned the files was “user” and “apache” just happened to have permission to read the files, but not write to them, then the web server could still get its job done. It could read the files, run the PHP scripts, do all the stuff it is supposed to do… but not modify the files.
This is why WordPress asks for FTP credentials. When it is self-updating, it notices that the WP files are owned by “user” but WordPress is actually running as “apache”. Thus, it can’t properly update without changing the owner. The “apache” user cannot write files owned by “user”. It doesn’t have this permission. More to the point, WordPress needs to create new files and delete old ones as well. So if it does that while running as “apache”, then the new files will be owned by “apache”, when they should be owned by “user”. It intentionally stops the update at that point because it cannot create files with the correct ownership.
Asking for FTP gives it a second approach. It can connect back to its own server via FTP, and using those credentials, it can write files as the correct user… For that one time only. After it disconnects, the credentials are forgotten. Safe all around.
In other words, when you put in FTP information, you are giving WordPress security credentials to be able to change the files that one time. By making the files owned by “apache” instead, you are giving WordPress the ability to change the files all the time, without any additional credentials. You have bypassed the security feature here, where as before, WordPress could not change the files without your login information, now it can. That’s a problem.
Now, maybe you don’t run the FTP service normally. Maybe you only use SSH. That’s okay too. In that case, look into adding the PHP SSH2 extension to your server’s PHP configuration. If WordPress finds that, instead of just FTP, you will also have the option for SFTP, which uses the SSH connection to authenticate and copy the files instead. Same principles apply, it’s trying to write files with the correct ownership for them to prevent security issues.
Security isn’t a binary thing, it has layers. If somebody gets unauthorized access, having things configured correctly can help to limit the amount of possible damage they can do. File and process ownership is a pretty low level bit of security in unix-type systems, but it’s still an important one.