WordPress File & Directory Permissions: Safe 2026 Setup Guide

The Danger of Insecure File Permissions

Setting file or folder permissions to 777 (read, write, execute for everyone) is one of the most hazardous security blunders on a web server. Any vulnerability in a neighbouring site on shared hosting or an unauthenticated file upload exploit can immediately execute malicious binaries on your server.

The Standard WordPress Permission Model

• All Directories: 755 (drwxr-xr-x) — Owner can read/write/navigate; everyone else can only read and navigate.
• All Files: 644 (-rw-r–r–) — Owner can read and write; everyone else can only read.
• wp-config.php: 600 or 440 — Locked strictly to the web server process.
• .htaccess: 644 or 444 — Read-only protection against unauthorized server redirects.

Automated Command to Reset Permissions via SSH

# Set all directories to 755
find /path/to/wordpress/ -type d -exec chmod 755 {} ;

# Set all files to 644
find /path/to/wordpress/ -type f -exec chmod 644 {} ;

# Restrict wp-config.php
chmod 600 /path/to/wordpress/wp-config.php

Troubleshooting Permission Denied & 403 Forbidden Errors

In real-world production environments, permission issues usually manifest as unexpected 403 Forbidden errors or failed media uploads stating “Unable to create directory wp-content/uploads”. This occurs when the web server process (such as www-data, nginx, or nobody) does not own the directory tree.

To safely resolve ownership mismatches without opening security vulnerabilities with 777, identify your server’s web user and execute a recursive ownership reset:

# Check active web server user
ps aux | egrep '(apache|httpd|nginx)'

# Assign proper ownership to web user (example: www-data)
sudo chown -R www-data:www-data /var/www/html

# Strictly protect critical configuration
sudo chmod 440 /var/www/html/wp-config.php

Applying 440 or 400 to wp-config.php ensures that even other system users cannot read database credentials or security salt keys.

Frequently Asked Questions

Can setting WordPress files to 777 cause website hacking?
Yes. Permission 777 grants universal write and execute privileges. Any neighboring site on shared hosting or an unauthenticated PHP upload script can overwrite files, inject malware, or establish persistent root backdoors.

What is the most secure permission level for wp-config.php?
The gold-standard permission for wp-config.php is 440 or 400. This grants read-only access strictly to the web server process and root user, entirely preventing external tampering.

Why do I get “Unable to create directory” when uploading images?
This error indicates an ownership conflict rather than a permission error. The directory might have 755, but if it belongs to root instead of your web server user (www-data), WordPress cannot write files into it.