{"id":18930,"date":"2026-10-21T20:17:44","date_gmt":"2026-10-21T17:17:44","guid":{"rendered":"https:\/\/www.hyyat.com\/knowledgebase\/secure-file-permissions\/"},"modified":"2026-10-21T20:17:53","modified_gmt":"2026-10-21T17:17:53","password":"","slug":"secure-file-permissions","status":"publish","type":"docs","link":"https:\/\/www.hyyat.com\/en\/knowledgebase\/secure-file-permissions\/","title":{"rendered":"Secure File Permissions for Your Website: When to Use 644 and 755, and Why to Avoid 777"},"content":{"rendered":"
\n
In short<\/b>Every file and folder on your site has a three-digit permission that decides who can read, write and execute it. The safe rule for most sites: folders 755, files 644 and wp-config.php 440 or 400. Never use 777, which lets anyone on the server modify the item; your site does not need it on our servers.<\/div>\n
\"File<\/figure>\n

What do the numbers mean?<\/h2>\n

The first digit is for the owner, the second for the group and the third for everyone. Each digit is the sum of three values:<\/p>\n

\n\n\n\n\n\n\n\n
Value<\/th>\nPermission<\/th>\nMeaning<\/th>\n<\/tr>\n<\/thead>\n
4<\/td>\nRead (r)<\/td>\nView the file\u2019s contents or list the folder.<\/td>\n<\/tr>\n
2<\/td>\nWrite (w)<\/td>\nEdit the file, or create and delete files in the folder.<\/td>\n<\/tr>\n
1<\/td>\nExecute (x)<\/td>\nRun the file, or enter the folder.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

For example, 644 means the owner reads and writes (4+2), the group only reads (4) and everyone only reads (4).<\/p>\n

The right permissions for your site<\/h2>\n
\n\n\n\n\n\n\n\n\n
Item<\/th>\nPermission<\/th>\nWhy<\/th>\n<\/tr>\n<\/thead>\n
Folders<\/td>\n755<\/td>\nThe account owner writes; the server enters and reads.<\/td>\n<\/tr>\n
Regular files<\/td>\n644<\/td>\nRead and served, edited only by the account owner.<\/td>\n<\/tr>\n
wp-config.php<\/td>\n440 or 400<\/td>\nThe most important file, read only. Read protecting wp-config.php<\/a>.<\/td>\n<\/tr>\n
.htaccess<\/td>\n644<\/td>\nRead by the server, edited only by the account owner.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n
Why is 777 dangerous?<\/b> A 7 for everyone means any process on the server can modify the file or add a new file to the folder. If a plugin or old guide asks for 777, do not apply it. On our servers PHP runs as the account owner, so it writes to its files with 755 and 644 without needing 777.<\/div>\n

How to change permissions<\/h2>\n
    \n
  1. In the cPanel File Manager:<\/b> Select the file or folder, click \u201cPermissions\u201d or \u201cChange Permissions\u201d, type the number and save.<\/li>\n
  2. For a whole site with commands:<\/b> If Terminal is available in your account, go to the site folder and run the commands below.<\/li>\n
  3. Check the site afterwards:<\/b> Open the home page and the dashboard and try uploading an image. If an error appears, open a ticket.<\/li>\n<\/ol>\n
    find . -type d -exec chmod 755 {} \\;\nfind . -type f -exec chmod 644 {} \\;\nchmod 440 wp-config.php<\/pre>\n
    Signs of a permission problem<\/h2>\n