How to properly delimit web server access rights?

Question

linux

I would like to sort out this issue once and for all.
There is a bunch of nginx+php5-fpm+mysql. Sites are located in /var/www:
/var/www/site1
/var/www/site2
...
There is a developer (login developer) who has access to the file system of all sites via ssh. Filling sites occurs through the admin panel.
Most of the instructions for installing web servers that can be found on the Internet say that /var/www should be owned by www-data , although why does he need them?
How to correctly, and most importantly, safely distinguish between rights?

Answer 1

The www-data owner only provides access to files to everyone who runs under this user or is a member of this group - nginx, php-fpm ...
Between whom and why are you going to differentiate rights? You have one developer, one web server too.
But you can set up separate php-fpm pools to somehow try to isolate sites from each other.