File and directory permissions
The permissions to use on web files, the ones that cause 500 errors, and why 777 is never the answer.
Set the right permissions on your website files. Applies to shared, reseller and Premium hosting.
The defaults
| Type | Permission |
|---|---|
| Directories | 755 |
| Files | 644 |
| Configuration files with credentials | 600 |
| Scripts run from cron or the shell | 700 |
.htaccess | 644, or 444 to make it read-only |
Uploaded files usually arrive with these already. You mostly need this when something is broken.
Why the exceptions matter
wp-config.php and similar — 600. These hold your database username and
password. 644 means any other user on the server can read them. PHP does not
need the file to be world-readable to include it, so there is no cost to
restricting it.
Scripts run from cron — 700. They are executed directly by your account
rather than interpreted by the web server, so they need the execute bit. Web
scripts do not.
.htaccess — 444 is worth considering. Making it read-only blocks a class
of attack where a compromised script appends redirect rules to it. You must
change it back to edit it, which is a fair trade for a file that rarely changes.
Never use 777. It permits anyone on the server to write to the file or
directory, and it is the single most common cause of a site being compromised
and reinfected repeatedly.
Guides that recommend it are working around a different problem — usually
ownership, not permissions. If something needs 777 to work, the cause is
elsewhere.
Fixing permissions in bulk
From SSH, in your document root:
find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;
chmod 600 wp-config.phpIn cPanel → File Manager, select a folder, choose Permissions, and tick Recurse into subdirectories, applying to files and directories separately.
What breaks, and why
500 Internal Server Error — usually a file or directory that is
group-writable or world-writable. Apache with suEXEC refuses to run scripts in
those conditions. Setting 755 and 644 fixes it.
403 Forbidden — a directory not readable, or missing the execute bit.
Directories need 755; 644 on a directory makes its contents unreachable.
WordPress cannot update or upload — genuinely a permissions problem, but the
answer is 755/644 with correct ownership, not 777. See
Resolving the "Unable to Create Directory" error.