A website is served by one or more programs running on the server. A common arrangement has a main process that listens on the network and a set of worker processes that handle the actual requests. With PHP-FPM, nginx or Apache passes PHP requests to a pool of separate PHP workers, each of which runs as a particular user.
The user matters. A worker that runs as a low-privilege account such as www-data can only touch what that account is allowed to, so a bug in the website does not automatically give an attacker control of the machine. A worker running as root would turn any code execution bug into full compromise.
Processes can also fail on their own. A crash in a worker is usually handled by the manager, which starts a replacement, so a site may look normal while a worker is repeatedly dying. Repeated restarts in the logs are a warning sign.
Run web processes as unprivileged users, separate different sites under different accounts where you can, and watch for unexpected child processes, because a web server that starts a shell is rarely normal.