Differentiation of rights on the server within the same domain?

Question

PHP

There is a site with the domain http://example.com, you need to add a blog to it with the address example.com/blog . How can you differentiate rights on the server so that when a blog is hacked (uploaded), an attacker cannot access the files of the main site?
How to configure Nginx so that work with the /blog subdirectory (in particular, php launch) is carried out as a different user (not the one under which the main site is running)?

Answer 1

two php-fpm from two users, and in nginx distribute everything according to their location

Answer 2

You need to create a new FTP user and set /blog in the start directory, then he will not be able to get to the main site.