What Are File Permissions?
File permissions (often referred to as CHMOD) dictate who can Read, Write, or Execute files on your web server. If your permissions are too loose, a hacker can easily write malicious PHP code to your server. If they are too strict, WordPress won't be able to upload images or update plugins.
Understanding the Numbers
Permissions are typically represented by three digits (e.g., 644 or 755). These numbers represent the permissions for the Owner, the Group, and Public/World.
Need immediate help?
If your site is currently hacked or showing warnings, our incident response team can help right now.
- 4 = Read
- 2 = Write
- 1 = Execute
You add these together. For example, 6 means Read (4) + Write (2). 7 means Read (4) + Write (2) + Execute (1).
The Correct WordPress File Permissions
To keep your site secure, you must apply the following permissions via FTP (like FileZilla) or your hosting cPanel/SSH.
Upgrade to Nexura Pro
Get enterprise-grade protection. Block zero-day exploits, advanced malware, and brute-force attacks instantly.
LIMITED TIME LAUNCH OFFER
1. Directories (Folders): 755
All folders within your WordPress installation (like `wp-admin`, `wp-content`, and `wp-includes`) should be set to 755. This means the Owner can read, write, and execute, while everyone else can only read and execute.
Never set a directory to 777. This gives anyone on the internet the ability to write files to your server.
2. Files: 644
All core files (like `index.php`, `wp-load.php`) should be set to 644. This allows the Owner to read and write, while the public can only read the files.
3. wp-config.php: 400 or 440
Your `wp-config.php` file contains your highly sensitive database passwords. It should be the most restricted file on your server. Set it to 400 or 440. This means it is strictly read-only, even for the owner.
4. .htaccess: 644 or 444
Your `.htaccess` file controls server routing. Set it to 644 so WordPress can write to it when updating permalinks, or 444 if you want to lock it down completely from malicious modifications.
Automating Permission Checks
Checking permissions manually can be tedious. Nexura Security includes an automated hardening module that scans your entire installation and flags any files or folders that have insecure permissions, allowing you to fix them with a single click.
