It is possible not to run the apache with www-data, but with the respective plesk user. Just like php fpm. In the top one sees there the user. It's good. But unfortunately not at apache. For everything it is www-data. Unfortunately, it happens so over and over again that hacked joomlas /...