I'm trying to configure a Linux server with secure permissions in /var/www. I've read that you shouldn't add your user account to the www-data group for various reasons. Instead, it's best (I'm told) to create a separate developer's group.

Here's what I did:

group add developers
usermod -a -G developers my_account
chown -R root:developers /var/www
find /var/www/ -type d -exec chmod 2775 {} \;
find /var/www/ -type f -exec chmod 664 {} \;

Also, edit /etc/apache2/envvars and add:

umask 002

Given the above, (a) am I reasonably secure and (b) how do I install/properly configure suEXEC to allow the sites to write (e.g. Wordpress)? Or, is there something else I should consider?