WordPress file permissions explained

File permissions decide who can read, write or run each file on your server, and on a shared or misconfigured host, "who" can mean more than just you. Getting them wrong in either direction causes real problems. Too strict and WordPress cannot update itself. Too loose and anyone who can reach the server can change your files directly, with no login at all.

What the numbers mean

Each permission is a three-digit number: one digit for the file's owner, one for its group, and one for everyone else. Each digit is a sum of read (4), write (2) and execute (1). So 7 is read, write and execute; 6 is read and write; 5 is read and execute; 4 is read only.

• 644: the owner can read and write; the group and everyone else can only read.
• 755: the owner can read, write and execute; the group and everyone else can read and execute.
• 600: only the owner can read and write. Nobody else can see the file.
• 777: everyone on the server can read, write and execute. This is the setting to be careful with.

For a directory, "execute" means permission to enter it, which is why directories need 755 rather than 644.

The standard WordPress scheme

• Directories: 755. The owner can add or remove files; everyone else can only look inside and read.
• Files: 644. The owner can edit; everyone else can only read.
• wp-config.php: 600 or 640. It holds your database credentials in plain text, so lock it down tighter than everything else. The wp-config.php guide explains how to choose between them.

Ownership matters as much as the numbers

Permissions apply to the owner, the group and everyone else. So the question "can WordPress write to this file?" depends on whether the account that runs PHP is the file's owner. If the files belong to a different account than the one running PHP, WordPress sees itself as "everyone else", and 644 will not let it write. That is the real cause of most upload and update errors.

The wrong response is to open everything to 777, which fixes the symptom by giving every account write access. The right response is to correct the owner, for example chown -R youraccount:youraccount /path/to/wordpress (on a host where you may change ownership), or to ask your host which account runs PHP. After that, the standard 644 and 755 scheme works.

Why 777 causes hacks

On shared hosting, "everyone else" is not hypothetical. It can include other accounts on the same server. A world-writable file or directory means any process that can reach the filesystem can modify it, which is how a single vulnerable plugin on one site can sometimes be used to write malicious files onto a neighbouring one. Even on a server you control, a 777 directory lets any flaw in any running service plant a file in your site.

777 is usually set by someone fixing an upload error the fast way, without finding out what the narrower fix should have been. It then stays for years. Because uploads are a common place for attackers to drop PHP, a world-writable wp-content/uploads is especially risky.

How to check your site's permissions

In your host's File Manager, the Permissions column shows the current setting for each item, and most let you right-click to change it. Over SSH, start by looking for trouble before changing anything:

• Find world-writable files: find . -type f -perm /o+w
• Find world-writable directories: find . -type d -perm /o+w
• Find files that are not 644 or directories that are not 755: find . -type f ! -perm 644 and find . -type d ! -perm 755

An empty result for the first two is what you want. To reset the whole install to the standard scheme, run these two commands from the WordPress folder:

find . -type d -exec chmod 755 {} \;

find . -type f -exec chmod 644 {} \;

Then set wp-config.php separately with chmod 600 wp-config.php. Always back up first and check you are in the right folder with pwd. A mistyped path can apply permissions across more than you intended.

Permissions as a detection signal

Permissions also tell you when something has changed. A new world-writable file in a core folder, or a PHP file in uploads with unusual permissions, is worth investigating. Combine the permission audit with the core file integrity check and the security checklist for a complete picture.