What is the 'principle of least privilege' in web server configuration, and how does it apply to the web server process?

• A.Least privilege: the web server process should run as a dedicated non-root user with read-only access to web files and no access to files outside the web root. Example: Nginx worker processes run as 'www-data' (limited user), while only the master process (which binds to port 80/443) runs as root - then drops privileges to the worker user
• B.Separation of duties: the web server process should run as root to read certificates from /etc/ssl, while a second process (the worker) writes to the document root and the log directory with the same account. Example: Apache prefork workers run as 'root' (full access), so any plugin can reach all system files, then the master drops privileges to the logging user
• C.Least privilege means the web server runs as a shared service account with write access to all web files: the same user that deploys code, so the process can update files in place. Example: Nginx runs as 'deploy' (a login user), while only the master process, which binds to port 80/443, uses a separate UID, and uploads are written by the master