Quick answer: WordPress file permissions are the rules on a Linux server that decide who can read, write and execute each file and folder. The safe defaults for most sites are 644 for files, 755 for folders, and 440 or 400 for wp-config.php. Never use 777, even to “fix” an upload or update error. If WordPress cannot write where it needs to, the real problem is usually file ownership, not permissions.
What file permissions are
Almost all WordPress hosting runs on Linux, and Linux attaches a set of permissions to every file and folder. Those permissions answer three questions for three groups of people.
The three questions:
- Read (r): can this person open and view the file?
- Write (w): can they change or delete it?
- Execute (x): can they run it as a program? For a folder, execute means they can open it and reach the files inside.
The three groups:
- Owner: the user account that owns the file, usually your hosting account user
- Group: a set of users who share access, which sometimes includes the web server
- Others: everyone else on the server, including any process that is not the owner or in the group
WordPress needs the right mix. PHP has to read your theme and plugin files to build pages. WordPress has to write to the uploads folder when you add an image. But nobody else on the server should be able to change your code.
Reading the numbers
Permissions are usually written as three digits, one per group (owner, group, others). Each digit is a sum:
- 4 = read
- 2 = write
- 1 = execute
So 7 is read, write and execute (4+2+1). 6 is read and write (4+2). 5 is read and execute (4+1). 4 is read only. 0 is nothing.
You will also see the letter form in file managers and on the command line, like -rw-r--r--. That is the same as 644: the owner can read and write, the group and others can only read.
Common values and what they mean
| Value | Letter form | Meaning |
|---|---|---|
| 644 | rw-r–r– | Owner can read and write; everyone else can read. Standard for files. |
| 755 | rwxr-xr-x | Owner has full access; everyone else can read and open. Standard for folders. |
| 640 | rw-r—– | Owner reads and writes, group reads, others get nothing. |
| 600 | rw——- | Only the owner can read and write. |
| 440 | r–r—– | Owner and group can read; nobody can write. |
| 400 | r——– | Only the owner can read. |
| 777 | rwxrwxrwx | Everyone can do everything. Never use this. |
Safe settings for WordPress
These recommendations match the guidance in the official WordPress documentation on hardening, and they suit most shared, VPS and managed hosting setups.
Folders: 755
All directories, including wp-admin, wp-includes, wp-content, and the folders inside it, should be 755. The owner can create and change files inside, while the web server can read and open them.
Files: 644
Every regular file, such as PHP files, CSS, images and .htaccess, should be 644. The web server can read them to serve pages, but only the owner can change them.
wp-config.php: 440 or 400
wp-config.php holds your database password and security keys, so it deserves tighter rules. 440 or 400 stops anyone from writing to it and limits who can read it. Some hosts run PHP in a way that needs 600 or 640 instead, so if your site shows an error after the change, try those before going back to 644. Our WordPress security checklist covers other ways to protect this file.
The uploads folder
wp-content/uploads must be writable by whatever user PHP runs as, because that is where WordPress saves media. With correct ownership, 755 is enough. If uploads fail, check ownership before you touch permissions.
.htaccess
Leave .htaccess at 644. WordPress writes to it when you change permalink settings, so if you lock it down to read only, update it by hand when needed.
Ownership matters as much as the numbers
Permissions say what the owner, group and others may do. Ownership decides who counts as the owner. This is where most WordPress problems come from.
On many servers, PHP runs as the same user that owns your files. This is common on shared hosts that use suPHP, PHP-FPM pools per account, or similar setups. In that case 644 and 755 work perfectly: PHP acts as the owner and can update plugins, save uploads and write cache files.
On other servers, PHP runs as a separate web server user, often named www-data, apache or nginx, while your files are owned by your account user. Now PHP falls into “others” and cannot write anything at 644 and 755. WordPress then asks for FTP credentials every time you update a plugin, and uploads may fail.
The fix is to correct ownership so the PHP user owns the files that need writing, not to open everything to 777. Your host or developer can set this up. If you are moving servers, ownership often changes along the way; our guide on moving WordPress to a new host points out where this usually goes wrong.
Why 777 is dangerous
777 gives every user and process on the server full control of the file. On a shared server, that can include other accounts. If any plugin on your site has a vulnerability, an attacker can drop a script into a 777 folder and run it. Many cleanups of a hacked WordPress site trace back to loose permissions that someone set to get past an error and then forgot.
Some hosts refuse to run PHP files that sit in a world-writable folder or are set to 777, which means the “fix” can also break your site.
How to check and change permissions
With an SFTP client or file manager
Most SFTP clients and hosting file managers show a permissions column. Right-click a file or folder and look for “File permissions” or “Change permissions” to enter the numeric value. Be careful with “apply to all subfolders” options, since files and folders need different values.
From the command line
If you have SSH access, these commands, run from your WordPress root folder, set the standard values:
find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;
chmod 440 wp-config.php
Take a backup first, and check with your host if you are on managed hosting, since some providers manage permissions for you. If you already work from the command line, WP-CLI is a handy companion for checking core files after a change.
Extra hardening options in wp-config.php
Permissions are one layer. A few constants add more:
define( 'DISALLOW_FILE_EDIT', true );removes the theme and plugin editor from the admin, so a stolen admin login cannot edit PHP code directly.define( 'DISALLOW_FILE_MODS', true );blocks all plugin and theme installs and updates from the admin. This suits sites deployed from version control, but it also turns off the plugin and theme auto-update options added in WordPress 5.5, so updates must come through your deployment process.define( 'FS_METHOD', 'direct' );tells WordPress to write files directly instead of asking for FTP details. Only use it when ownership is set correctly, never as a shortcut around wrong ownership.
The Site Health screen can also flag some file access problems, such as when WordPress cannot update itself. Our guide to the WordPress Site Health screen explains those checks.
FAQ
What are the correct WordPress file permissions?
644 for files, 755 for folders, and 440 or 400 for wp-config.php. Some hosting setups need 600 or 640 for wp-config.php instead.
Why does WordPress ask for FTP details when I update a plugin?
PHP cannot write to your files, usually because it runs as a different user from the file owner. Fix the ownership rather than loosening permissions.
Is 775 safe?
775 gives the group write access. It can be acceptable on a server where the group contains only your account and the web server, but 755 is the safer default for most sites.
Should I change permissions on a managed WordPress host?
Usually not. Managed hosts set permissions and ownership for their platform. Ask support before changing anything.
Keep your server tidy
WordPress file permissions are a small setting with a big effect on security. Stick to 644 and 755, lock down wp-config.php, never reach for 777, and fix ownership when WordPress cannot write. If you would like a developer to review your server setup as part of a secure, well-built site, talk to our WordPress development team.
