Wordpress ftp privileges?

Question

linux

Hi friends! There was a difficulty in securing a directory accessible from Apache.
Apache works from under www-data, I connect via ftp username, wordpress is updated, downloads from under www-data.
If you set the owner to www-data 755 for directories and 644 for files, then ftp does not work; if username, then wordpress update does not work. I add username to the www-data group and set 775 and 664: everything works, but spammers break the root directory and create their own redirects from under www-data. How to be?

Answer 1

As a result, I reinstalled everything, while the flight is normal. It seems to me that these are broken nulled plugins