# File and directory permissions
Source: https://docs.webgee.com/en/hosting/what-file-and-directory-permissions-should-i-use-for-my-web-files



Set the right permissions on your website files. Applies to shared, reseller and
Premium hosting.

## The defaults [#the-defaults]

| Type                                 | Permission                           |
| ------------------------------------ | ------------------------------------ |
| Directories                          | `755`                                |
| Files                                | `644`                                |
| Configuration files with credentials | `600`                                |
| Scripts run from cron or the shell   | `700`                                |
| `.htaccess`                          | `644`, or `444` to make it read-only |

Uploaded files usually arrive with these already. You mostly need this when
something is broken.

## Why the exceptions matter [#why-the-exceptions-matter]

**`wp-config.php` and similar — `600`.** These hold your database username and
password. `644` means any other user on the server can read them. PHP does not
need the file to be world-readable to include it, so there is no cost to
restricting it.

**Scripts run from cron — `700`.** They are executed directly by your account
rather than interpreted by the web server, so they need the execute bit. Web
scripts do not.

**`.htaccess` — `444` is worth considering.** Making it read-only blocks a class
of attack where a compromised script appends redirect rules to it. You must
change it back to edit it, which is a fair trade for a file that rarely changes.

<Callout type="error">
  **Never use `777`.** It permits anyone on the server to write to the file or
  directory, and it is the single most common cause of a site being compromised
  and reinfected repeatedly.

  Guides that recommend it are working around a different problem — usually
  ownership, not permissions. If something needs `777` to work, the cause is
  elsewhere.
</Callout>

## Fixing permissions in bulk [#fixing-permissions-in-bulk]

From SSH, in your document root:

```bash
find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;
chmod 600 wp-config.php
```

In **cPanel → File Manager**, select a folder, choose **Permissions**, and tick
**Recurse into subdirectories**, applying to files and directories separately.

## What breaks, and why [#what-breaks-and-why]

**500 Internal Server Error** — usually a file or directory that is
group-writable or world-writable. Apache with suEXEC refuses to run scripts in
those conditions. Setting `755` and `644` fixes it.

**403 Forbidden** — a directory not readable, or missing the execute bit.
Directories need `755`; `644` on a directory makes its contents unreachable.

**WordPress cannot update or upload** — genuinely a permissions problem, but the
answer is `755`/`644` with correct ownership, not `777`. See
[Resolving the "Unable to Create Directory" error](/en/hosting/wordpress/resolving-the-unable-to-create-directory-error-in-wordpress).

## Related [#related]

* [Manage files in cPanel](/en/hosting/how-to-manage-files-in-cpanel)
* [Where to upload your website files](/en/getting-started/where-should-i-upload-my-website-files)