Currently the '''php_website''' and '''wsgi_website''' roles allow the user to specify website administrator that will be granted write permissions on website files.

This can have possible security repercussions in cases where the specified administrator is used also for administering other websites or even worse has sudo privileges. For example, with '''wsgi_website''' role the administrator would be activating the virtual environment with a lot of different packages, and some of those might be malicious.

It would be better to instead have dedicated administrator users for each website.

For example, if the website user/group is '''web-test_example_com''', the role could create an administrator user that belongs to group '''web-test_example_com''' with username '''admin-test_example_com'''. The admin should only be created if user has not explicitly specified an administrator.

A tiny enhancement for the wsgi_website role would be to auto-activate the virtual environment when switching to the administrator user as well.