I'm new to linux and want to host a website on dedicated server, I put the php files in the public "www" directory along with private folder that should be accessed only by the server itself (I mean php scripts writing and reading files in the folder). I read that the Apache server operates under account "www-data", so I set that account as folder owner with permissions 700, but I can still access this folder from web browser at home, until I remove the www-data permissions. Is it normal that the website visitors use the same account as web server? If so, how can I configure the permissions correctly so only PHP script can access the files within dir?
Here's the test file and it's permissions
22.214.171.124/prywatny/test.txt -rwx------ 1 www-data www-data 4 sie 9 08:28 test.txt