What Are File Permissions?

On operating systems and file systems that support them, such as Linux file systems and Windows NTFS, each file and directory carries a set of permissions that governs who can interact with it and how. Simple formats like FAT32, common on USB drives, store no permissions at all.

What you can do with a file depends on who you are to it. Unix-like systems give every file 3 sets of read, write, and execute switches: one for the file's owner, one for the owning group, and one for everyone else. For a file, read lets you view the contents, write lets you change them, and execute lets you run the file as a program or script.

Directories use the same 3 permissions with different meanings: read lists the names inside, write lets you create, rename, or delete entries, and execute lets you enter the directory or pass through it. Two consequences follow. Deleting a file is controlled by write permission on its parent directory, not by the file's own write setting. And because opening a directory requires execute, directories need permissions like 755 where plain files use 644.

Depending on which class you fall into, you might be able to read a file but not change it. Execute permission is a separate grant: it controls who can run a file, not who can open it.

Superuser accounts (root on Linux, Administrator on Windows) sit above these rules rather than holding the best set of them: on Linux, processes running as root bypass file permission checks entirely. Ordinary users can still hold full read, write, and execute permissions on the files they own.

Permission numbers: 644, 755, and 777

Each permission has a numeric value: read is 4, write is 2, and execute is 1. Add the values for each class and write the totals in owner, group, everyone-else order, and you get the 3-digit codes that tutorials and FTP clients use:

• 755: the owner can read, write, and execute (4+2+1); the group and everyone else can read and execute (4+0+1). The standard setting for directories, which need execute permission before anyone can open them.
• 644: the owner can read and write (4+2), while everyone else can only read (4). The standard setting for ordinary files.
• 777: everyone can do everything. Treat it as a warning sign, not a fix.

The same settings appear as a string like -rwxr-xr-x in an FTP client or in ls -l output: after the first character (the file type), the 3 rwx groups belong to the owner, the group, and everyone else, with a dash for each permission that's switched off. That string is 755 spelled out in letters.

Recommended permissions for a website

For a WordPress or other PHP site on a standard Linux server, the WordPress Advanced Administration Handbook recommends 755 for directories and 644 for files. Sensitive files deserve stricter settings: wp-config.php is created with 644 permissions, the handbook calls leaving it that way a hazard, and tightening it to 640 or 600 closes the gap.

Those values aren't universal. Permission schemes differ from host to host: shared hosting that runs suexec works on different ownership assumptions, and some multi-user setups need group-writable 775 and 664 instead. When your host publishes its own recommended values, use those.

Checking and changing permissions

You have 3 routes to the same setting:

• An FTP or SFTP client: right-click a file and choose File Permissions (often labeled CHMOD) to view or edit the numeric value.
• Your host's file manager: most hosting panels show permissions next to each file and let you change them in place.
• The command line over SSH: chmod 644 filename sets a file's permissions directly.

Check before you change. When a script fails, look at its permissions first, and adjust only the files an error message or your host's documentation points you to.

Permission errors and security risks

Permission problems break sites in 2 directions. Too strict, and the web server can't read or write what it needs: the usual symptoms are 403 Forbidden pages, "permission denied" entries in the error log, and the WordPress "Upload: failed to write file to disk" error. Our guide to fixing the failed-to-write-to-disk error walks through the permission fix.

Too loose is worse. Setting a file to 777 gives every account on the server the ability to modify it, so one compromised process can write malicious code into your site. Never answer an error by loosening everything to 777: find the value the application actually needs, which for web files is almost always 644, or 755 for directories.

Linux vs. Windows permission models

Everything above describes the Unix and Linux model, which is what you'll meet on the Linux servers common in web hosting. Windows servers work differently: NTFS access control lists grant permissions such as Read, Write, Modify, and Full Control to specific users and groups, so numeric modes like 644 mean nothing there. The permission model itself varies by operating system, and instructions written for one don't transfer to the other.