File Permissions: 644, 755 and Why You Should Never Use 777

The advice "the plugin won't upload, set permissions to 777" is everywhere online. It rarely fixes the problem and puts your site at needless risk. First, what permissions mean.

What do the permission numbers say?

On Linux, every file and folder has permissions for three groups: the owner, the group and others. Each group has three rights: read (4), write (2) and execute (1). The sum of these numbers is that group's permission.

For folders, "execute" means the folder can be entered. That's why the standard is 755 for folders and 644 for files.

Recommended permissions for WordPress

• Folders: 755
• Files: 644
• wp-config.php: it contains the database password, so it can be more restricted. WordPress's hardening guide suggests 440 or 400; you can also use a value such as 600 or 640, checking that the site keeps working.

Why is 777 dangerous?

777 means any process on the server can change that file. A single vulnerability in your site makes it easier for an attacker to write malicious code into those files. And on systems like ours, where PHP runs as the account owner's user, 777 isn't needed anyway: with 644 and 755, WordPress can upload files and run updates. Some server configurations refuse to execute world-writable files for security reasons, and the page returns a 500 error.

How to change permissions

1. Open File Manager in cPanel.
2. Right-click the file or folder and choose Change Permissions.
3. Tick the boxes or type the numeric value, then save.

Most FTP programs do the same from the right-click menu.

If you get "permission denied"

This error is usually a problem of ownership, not permissions. Files moved from another server, for example, may appear to belong to a different user. Instead of setting 777, open a support ticket and we'll correct the ownership for your account.

Unexpected permission changes are a warning sign

If you see 777 permissions or PHP files you don't recognise that you didn't create, your site may have been accessed without authorisation. Follow the steps in our guide to suspicious changes and change your passwords.