---
title: "Secure File Permissions for Your Website: When to Use 644 and 755, and Why to Avoid 777"
description: "**In short**Every file and folder on your site has a three-digit permission that decides who can read, write and execute it. The safe rule for most sites: folders 755, files 644 and wp-config.php 440 or 400. Never use 777, which…"
url: "https://www.hyyat.com/en/knowledgebase/secure-file-permissions/"
updated: "2026-10-21"
category: Website Security
---

# Secure File Permissions for Your Website: When to Use 644 and 755, and Why to Avoid 777

**In short**Every file and folder on your site has a three-digit permission that decides who can read, write and execute it. The safe rule for most sites: folders 755, files 644 and wp-config.php 440 or 400. Never use 777, which lets anyone on the server modify the item; your site does not need it on our servers.

![File permissions: a folder set to 755, files set to 644 and a lock](https://www.hyyat.com/wp-content/uploads/2026/10/hkb-file-permissions.webp)

## What do the numbers mean?

The first digit is for the owner, the second for the group and the third for everyone. Each digit is the sum of three values:

| Value | Permission | Meaning |
| --- | --- | --- |
| 4 | Read (r) | View the file’s contents or list the folder. |
| 2 | Write (w) | Edit the file, or create and delete files in the folder. |
| 1 | Execute (x) | Run the file, or enter the folder. |

For example, 644 means the owner reads and writes (4+2), the group only reads (4) and everyone only reads (4).

## The right permissions for your site

| Item | Permission | Why |
| --- | --- | --- |
| Folders | 755 | The account owner writes; the server enters and reads. |
| Regular files | 644 | Read and served, edited only by the account owner. |
| wp-config.php | 440 or 400 | The most important file, read only. Read [protecting wp-config.php](https://www.hyyat.com/en/knowledgebase/protect-wp-config/). |
| .htaccess | 644 | Read by the server, edited only by the account owner. |

  **Why is 777 dangerous?** A 7 for everyone means any process on the server can modify the file or add a new file to the folder. If a plugin or old guide asks for 777, do not apply it. On our servers PHP runs as the account owner, so it writes to its files with 755 and 644 without needing 777.

## How to change permissions

1. **In the cPanel File Manager:** Select the file or folder, click “Permissions” or “Change Permissions”, type the number and save.
2. **For a whole site with commands:** If Terminal is available in your account, go to the site folder and run the commands below.
3. **Check the site afterwards:** Open the home page and the dashboard and try uploading an image. If an error appears, open a ticket.

```
find . -type d -exec chmod 755 {} ;
find . -type f -exec chmod 644 {} ;
chmod 440 wp-config.php
```

## Signs of a permission problem

- A `403 Forbidden` message on a page or file: the permission is too low.
- A `500` error after changing permissions: some servers refuse to run PHP files writable by everyone.
- WordPress asks for FTP details when installing a plugin: file ownership is wrong; open a ticket and we will fix it.

## How Hyyat Host protects your site

- **CloudLinux** places every account in its own environment, so no other account can see your files even at 644.
- PHP runs as the account owner, so no plugin or upload folder needs 777.
- **ImunifyAV** scans files daily and detects new malicious files.

## Frequently asked questions

   What permission should the uploads folder have?

755, like other folders. WordPress uploads images into it with this permission on our servers.

   Do correct permissions prevent hacking?

They limit damage and close an important door, but they do not replace updates and strong passwords.

   How do I see a file’s permission?

The cPanel File Manager shows a Permissions column next to every file and folder.

   **Related guides**

- [How to Protect wp-config.php in WordPress: 7 Steps to Secure Your Most Important File](https://www.hyyat.com/en/knowledgebase/protect-wp-config/)
- [Types of Website Malware and How to Recognise Each One](https://www.hyyat.com/en/knowledgebase/website-malware-types/)
- [What Is a C99 Shell? How It Gets In and How to Find and Remove It](https://www.hyyat.com/en/knowledgebase/hacking-tools-c99-shell/)
- [How to Protect Your Website from Hacking: 10 Practical Steps](https://www.hyyat.com/en/knowledgebase/protect-website-from-hacking/)

[All website security guides →](https://www.hyyat.com/en/kb/website-protection/)

  **Need this service from Hyyat Host?**Our team handles it for you, with support replying to tickets within 24 hours at most.[Web Hosting](https://www.hyyat.com/en/hosting/)[Saudi Hosting](https://www.hyyat.com/en/saudi-hosting/)