What Are File Permissions & How to Set Them Right

What File Permissions Actually Mean

File permissions are rules on a web server that control who can do what with a file or a folder. In plain English, they determine who gets to read, write to, or run a file. These rules are critical for both security and functionality. If they're too loose, you're inviting hackers; if they're too tight, your website will break. You’ll typically see them represented as a three-digit number, like 755 or 644, which is a shorthand for these rules.

Think of it this way: every file and folder on your hosting account has three sets of permissions for three types of users. The users are the Owner (you), the Group (other accounts on the server in a shared group), and the Public (everyone else, i.e., website visitors). The permissions are Read (the ability to view contents), Write (the ability to change contents), and Execute (the ability to run a file or script). The numeric code simply summarizes which of these three users gets which of these three permissions.

Decoding the Numbers: Read (4), Write (2), Execute (1)

The three-digit code might seem cryptic, but it’s simple math. Each permission has a numeric value: Read (r) is 4, Write (w) is 2, and Execute (x) is 1. To set the permissions for one user type (like the Owner), you just add up the values for the actions you want to grant. For example, to give an owner full control (read, write, and execute), you’d add 4 + 2 + 1 = 7.

The three digits in a permission code like 755 correspond to the Owner, Group, and Public, in that order. So, a 755 permission breaks down like this: The Owner gets a 7 (4+2+1), meaning they can read, write, and execute. The Group gets a 5 (4+0+1), meaning they can only read and execute. The Public also gets a 5 (4+0+1), so they can also only read and execute. This is a common and safe setting for directories.

Similarly, the standard permission for files is 644. This means the Owner gets a 6 (4+2+0), allowing them to read and write the file. The Group and the Public both get a 4 (4+0+0), meaning they can only read the file. This makes perfect sense: you don't want the general public to be able to change your website's files or execute them if they aren't scripts.

The Correct Permissions for WordPress & Most Websites

Getting permissions wrong is one of the most common ways websites get hacked. A permission setting of 777, for instance, gives everyone—including any anonymous visitor or bot—the ability to read, write, and execute. This is like leaving your house keys in the front door. A hacker can easily upload a malicious script to a folder with 777 permissions and take over your site. There is almost no valid reason to ever use 777 on a live web server.

Here are the golden rules for a standard setup, especially for CMS platforms like WordPress, Joomla, or Drupal. Sticking to these will keep your site secure and functional.

For directories and folders, the correct permission is 755. This allows the server to navigate into folders to find the files it needs to display your site, but it prevents others from making unauthorized changes. For all files, the correct permission is 644. This allows the server to read the files (like your images, CSS, and PHP files) but prevents them from being modified by outsiders.

One critical exception is your `wp-config.php` file in WordPress (or equivalent configuration files for other platforms). This file contains your database credentials. For maximum security, its permissions should be set to 600 or 444. A setting of 600 means only the Owner can read and write it, and no one else can even see it. This hardens your site significantly against attacks that try to read your database password.

How to Change File Permissions (2 Easy Ways)

Fixing your file permissions is straightforward, and you can usually do it in two ways: via an FTP client or your hosting control panel's File Manager. Using an FTP client like FileZilla is a popular method. Simply connect to your server, right-click on the file or folder you want to change, and select 'File permissions...'. A dialog box will appear where you can either check the boxes for read/write/execute or, more easily, just type the numeric value (e.g., '755') into the text field.

Your other option is the File Manager inside your hosting control panel (like cPanel or Plesk). Navigate to the file or folder, select it, and look for a 'Permissions' or 'Change Permissions' button in the toolbar. This will open a similar interface where you can manage the settings. Most file managers have a useful 'recursive' option for directories, allowing you to apply the same permissions to all files or folders within it—a huge time saver for correcting an entire site.