Nexura Security
Download Free

100% Free · No credit card required

Back to Blog
Best Practices August 10, 2026 6 Views

The Ultimate Guide to WordPress File Permissions

nexurasecurity
Nexura Security
Security Researcher
The Ultimate Guide to WordPress File Permissions

What Are File Permissions?

File permissions (often referred to as CHMOD) dictate who can Read, Write, or Execute files on your web server. If your permissions are too loose, a hacker can easily write malicious PHP code to your server. If they are too strict, WordPress won't be able to upload images or update plugins.

Understanding the Numbers

Permissions are typically represented by three digits (e.g., 644 or 755). These numbers represent the permissions for the Owner, the Group, and Public/World.

Need immediate help?

If your site is currently hacked or showing warnings, our incident response team can help right now.

Fix My Site Now

  • 4 = Read
  • 2 = Write
  • 1 = Execute

You add these together. For example, 6 means Read (4) + Write (2). 7 means Read (4) + Write (2) + Execute (1).

The Correct WordPress File Permissions

To keep your site secure, you must apply the following permissions via FTP (like FileZilla) or your hosting cPanel/SSH.

Sponsored Pro Version

Upgrade to Nexura Pro

Get enterprise-grade protection. Block zero-day exploits, advanced malware, and brute-force attacks instantly.

Get 50% Off Now

LIMITED TIME LAUNCH OFFER

1. Directories (Folders): 755

All folders within your WordPress installation (like `wp-admin`, `wp-content`, and `wp-includes`) should be set to 755. This means the Owner can read, write, and execute, while everyone else can only read and execute.

Never set a directory to 777. This gives anyone on the internet the ability to write files to your server.

2. Files: 644

All core files (like `index.php`, `wp-load.php`) should be set to 644. This allows the Owner to read and write, while the public can only read the files.

3. wp-config.php: 400 or 440

Your `wp-config.php` file contains your highly sensitive database passwords. It should be the most restricted file on your server. Set it to 400 or 440. This means it is strictly read-only, even for the owner.

4. .htaccess: 644 or 444

Your `.htaccess` file controls server routing. Set it to 644 so WordPress can write to it when updating permalinks, or 444 if you want to lock it down completely from malicious modifications.

Automating Permission Checks

Checking permissions manually can be tedious. Nexura Security includes an automated hardening module that scans your entire installation and flags any files or folders that have insecure permissions, allowing you to fix them with a single click.

Share this article:
Nexura Security Team

Nexura Security Research Team

WordPress Security Experts

The Nexura Research Team continuously monitors the WordPress ecosystem for emerging threats, zero-day vulnerabilities, and malware trends. Our mission is to provide actionable intelligence to keep your websites secure, fast, and resilient against modern cyber attacks.

nexurasecurity

Written by Nexura Security

Did this article help? If you need professional assistance implementing these security measures or recovering from a hack, we are just a click away.

Comments (0)

No comments yet. Be the first to share your thoughts!

Leave a Comment

You must be logged in to post a comment.

Log In

Secure Your WordPress Site Today

Get enterprise-grade protection with Nexura Security. Setup takes less than 60 seconds.

Download Free Plugin

Stay Ahead of Hackers

Join our growing community of site owners who receive our weekly WordPress security alerts, vulnerability reports, and hardening tips.

SSL Secured
GDPR Compliant
WP.org Verified
OWASP Protected
Secure Your Infrastructure Today