08Website know-how & errors

File and folder permissions – chmod 644, 755 and 777 explained

What file permissions are, how chmod numbers like 644, 755 and 600 work, why 777 is dangerous and which permissions WordPress and wp-config.php need at Nexthosting.

In short

Files usually get 644, folders 755, and sensitive files such as wp-config.php get 600 or 640. Permissions of 777 (“everyone may do everything”) are almost never right and are a security risk. Wrong permissions cause error 403, 500 or “file cannot be saved”.

How permissions work

Every file and every folder on a Linux server has:

an owner (user),
a group,
permissions for three sets of people: the owner, the group and everyone else.

For each set there are three permissions:

Letter	Number	For files	For folders
`r` (read)	4	read	list contents
`w` (write)	2	modify	create and delete files
`x` (execute)	1	execute	enter

The number for one set is the sum: read + write = 4 + 2 = 6, read + execute = 4 + 1 = 5, everything = 7. Three digits side by side give the value: owner, group, others.

644  =  rw-  r--  r--
         |    |    |
         |    |    +-- everyone else: read only
         |    +------- group: read only
         +------------ owner: read and write

The most important values

Value	Meaning	Typical for
`644`	Owner reads and writes, others only read	normal files (PHP, HTML, images)
`755`	Owner everything, others read and enter	folders, scripts
`600`	Only the owner may read and write	secret files (credentials)
`640`	Owner reads and writes, group reads	sensitive files, if the web server reads through the group
`400`	Only the owner may read	private keys (`.key`)
`700`	Only the owner has access	private folders
`777`	Everyone may do everything	do not use

Show and change permissions

In the file manager or SFTP program

Most programs (FileZilla, WinSCP, Cyberduck) show the permissions in a column. Right-click the file and choose File permissions (or similar), then enter the number or tick the boxes. Guide to access: Upload files via SFTP.

Via SSH

At Nexthosting, SSH is available with web hosting in every plan, and with WordPress hosting from the Basic plan.

# View permissions
ls -l
ls -la wp-config.php

# Change one file
chmod 644 file.php

# Change one folder
chmod 755 folder

# Reset all folders and files in the website directory
find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;

# Protect a sensitive file
chmod 600 wp-config.php

The output of ls -l looks like this:

-rw-r--r--  1 user group  4210 Oct 18 10:12 index.php
drwxr-xr-x  5 user group  4096 Oct 18 10:12 wp-content

The first character says whether it is a file (-) or a folder (d). Then come three times rwx: owner, group, others.

The owner is decisive

Permissions alone are not enough. The owner must be right too. If files belong to a different user than the one your website runs as, PHP cannot change them, even with 755. This happens after restores, moves, or when files were uploaded with a different login. You usually cannot change the owner yourself then. Contact support (Support) and give them the path.

WordPress: which permissions do files need?

Path	Permissions	Note
Folders in general	`755`
Files in general	`644`
`wp-config.php`	`600` or `640`	Contains database access and keys. Do not make it publicly readable.
`wp-content/uploads`	`755` (folder), `644` (files)	WordPress must be able to write here
`.htaccess`	`644`	WordPress must be able to write it when permalinks change

For updates through the WordPress dashboard, the web server user must be allowed to modify files. That depends on the owner, not on 777.

More on looking after WordPress: Maintaining WordPress.

Symptoms of wrong permissions

Symptom	Possible cause	Solution
403 Forbidden on one file	Permissions too strict (e.g. `600` on images)	Set `644`
403 on the whole site	Main folder not readable	Folder `755`
500 Internal Server Error	`777` on scripts, wrong owner	Set `644`/`755`
“File could not be saved”	Folder not writable or wrong owner	Check permissions and owner
Upload fails	`uploads` not writable	Check the owner
Plugin installation fails	WordPress is not allowed to write	Check the owner

More: Error 403 and Error 500.

Decision aid

Which permissions should I set?

Normal file (PHP, HTML, image)644

Folder755

File with passwords (wp-config.php, .env)600 or 640

Private key400 or 600

A guide says 777Do not adopt it blindly: check the owner or ask support

Frequently asked questions

My guide says I should set everything to 777. May I?

No. Set 644 or 755 and check the owner. If it still does not work, ask support.

Can I break permissions by accident?

Yes, for example with chmod -R 000. Note the original state beforehand and make a backup (Backups and restoring).

What does the `x` mean for folders?

Without x, nobody can enter the folder, even if they may read it. Folders therefore almost always need 755.