WordPress file permissions determine who can read, change or run the files stored on your hosting account. When they are configured incorrectly, you may be unable to upload images, install plugins or complete an update. Make them too permissive, however, and you can create an unnecessary security risk.
For many WordPress installations, 644 for files and 755 for directories is a sensible starting point. These numbers are not a universal fix. File ownership, server configuration and your hosting provider’s security controls also affect what WordPress can access.
If your website currently works normally, do not change its permissions simply because you have found a different recommendation online. Permission changes are best treated as a targeted repair, not routine WordPress maintenance.
What are WordPress file permissions?
Your WordPress website consists of files and directories held on a server. These include WordPress core, plugins, themes, uploaded media and the important wp-config.php configuration file.
Server permissions control three basic actions:
- Read: view or retrieve a file’s contents.
- Write: change, replace or delete a file.
- Execute: run a file or access the contents of a directory.
Those rights are assigned separately to the file’s owner, an associated user group and everyone else on the server. The three-digit permission number is a compact way of describing that access.
What do the numbers 644 and 755 mean?
Each digit represents a different class of user. The values come from adding read, write and execute rights together:
- 4 means read.
- 2 means write.
- 1 means execute.
A setting of 644 therefore gives the owner read and write access, while the group and everyone else receive read-only access. A setting of 755 gives the owner full access while allowing other users to read and enter the directory without modifying it.
| Setting | Common use | What it generally allows |
|---|---|---|
| 644 | WordPress files | The owner can read and write; other users can read. |
| 755 | WordPress directories | The owner can read, write and access; other users can read and access. |
| 600 | Sensitive files on some servers | Only the owner can read and write. |
| 777 | Not a normal WordPress solution | Everyone can read, write and execute. |
The official WordPress file-permissions guide explains these modes in more technical detail. It also makes an important point: a professionally configured website will not normally need its permissions changed unless there is an identifiable problem.
Are 644 and 755 always the correct settings?
No. They are widely used defaults, but the correct answer depends on how your hosting server runs PHP and which account owns the WordPress files.
Some servers use 640 for files and 750 for directories. Others require selected directories to be writable by a particular group. Managed WordPress hosts may also control permissions automatically and restore their preferred settings after deployments or updates.
This is why copying a recursive permission command from a forum can be dangerous. It may overwrite carefully configured permissions throughout your website, including exceptions required by your host, caching system or deployment process.
If WordPress cannot write to a file, the real problem may be file ownership rather than its numerical permission. Changing 644 to 664 or 777 might appear to bypass the symptom while leaving the underlying ownership problem unresolved.
Why you should not set WordPress directories to 777
A permission of 777 allows the owner, group and everyone else to read, modify and execute the affected item. It is sometimes suggested as a quick fix when uploads or updates fail, but it grants far more access than a normal WordPress installation should need.
The official WordPress guidance warns that no directory should be given 777 permissions under common server configurations. Even when a temporary test appears to work, leaving world-writable permissions in place can make it easier for another compromised process or account on the server to alter your files.
Permissions alone cannot make a website completely secure, but restricting write access helps limit what can be changed. WordPress describes security as risk reduction rather than risk elimination in its WordPress hardening guidance.
Does wp-config.php need stricter permissions?
The wp-config.php file deserves particular care because it contains database connection details, authentication settings and other sensitive configuration values.
WordPress documentation notes that settings such as 400 or 440 may be appropriate where the website and server can still read the file correctly. Some hosting environments instead use 600 or retain 640 or 644 alongside server rules that prevent public access.
Do not apply a stricter value without checking that it is compatible with your host. If the web server loses access to wp-config.php, the website may stop loading.
Signs that your website may have a permission problem
Common symptoms include:
- WordPress cannot create a directory during an update.
- Media uploads fail despite valid file types and available storage.
- A plugin cannot create cache, backup or log files.
- WordPress unexpectedly requests FTP details when installing an update.
- Files edited through SFTP do not appear to change on the live website.
- You receive “permission denied”, 403 or file-not-writable messages.
These symptoms do not prove that numerical permissions are wrong. Storage limits, security policies, plugin errors, incorrect paths and ownership problems can produce similar messages.
How to correct WordPress permissions safely
1. Create and verify a backup
Take a complete backup before changing server files. A successful notification is not enough on its own, so follow our guide to testing a WordPress backup if you have not already checked that yours can be restored.
2. Record the current settings
Use your hosting file manager or an SFTP client to note the current owner and permissions of the affected item. A screenshot can make it much easier to reverse the change.
3. Identify the smallest affected area
If one upload directory is unwritable, do not immediately change every file in the WordPress installation. Start with the exact directory named in the error.
4. Ask your host to check ownership
Your hosting provider can confirm which account should own the files and whether PHP runs as your account, a shared web-server user or another process. This is often safer than increasing access until an error disappears.
5. Test away from the live site where possible
A WordPress staging site gives you somewhere to test server and application changes without interrupting visitors, bookings or orders.
6. Test the original action again
Repeat the upload, update or plugin task that failed. Check the front end, WordPress dashboard and any affected forms or ecommerce functions. If the change does not solve the problem, restore the previous setting rather than making the permissions progressively wider.
Can changing permissions remove WordPress malware?
No. Correcting permissions may reduce unnecessary write access, but it does not identify malicious files, remove injected code or close the vulnerability that allowed an infection.
If you find unfamiliar PHP files, altered core files, spam pages or repeated unauthorised changes, preserve the evidence and arrange a proper investigation. ThriveWP’s WordPress malware removal service can clean the infection and help identify the next security steps.
Do you need help with a WordPress permission error?
File permissions are easy to describe but can be difficult to repair safely because the numbers are only one part of the server configuration. If your updates, uploads or plugins have stopped working, avoid using 777 as a shortcut or applying a blanket command without a recovery plan.
Our WordPress support service can investigate the error, check ownership and permissions, and address the cause without guessing. Talk To Us if you need help with a specific website problem.
Keep your WordPress website in better shape. Download the free site-care guide and join the ThriveWP newsletter for clear maintenance, security and troubleshooting advice.
