Tutorial
File permissions for a website, explained
What 644 and 755 mean, why 777 is never the fix, and how to repair a site that has the wrong ones.
- Set files to 644 and directories to 755. This is all you need for a normal website.
- 777 gives everyone write access and gets your scripts blocked by the server with a 500 error.
- Use your FTP client or web file manager to set permissions during upload or at any time.
- If a script asks for 777, find another script or ask the developer for a supported alternative.
You have been told to “chmod 777” a file. That advice is dangerous and every shared host will block it. This page explains what the numbers mean and why 644 and 755 are the only permissions you need.
The three digits
File permissions have three positions: owner, group, and other. Owner is your account. Group is a collection of accounts on the server. Other is everyone else on the internet who accesses your site. Each position has three possible actions: read, write, execute.
The digits come from adding values. Read is 4, write is 2, execute is 1. You add them to get a single number for each position.
The table below shows the common combinations.
| Digit | Permissions | Meaning for a file | Meaning for a directory |
|---|---|---|---|
| 7 | 4+2+1 | Read, write, execute | List, create, enter |
| 6 | 4+2 | Read and write | Names only — cannot enter or create |
| 5 | 4+1 | Read and execute | List and enter |
| 4 | 4 | Read only | Names only — cannot open the files |
So 644 means owner can read and write (6), group can read (4), other can read (4). 755 means owner can do everything (7), group can read and enter (5), other can read and enter (5).
The two numbers that work
For files: 644 always. For directories: 755 always. That is the whole answer for a normal website.
- A file needs read permission so the web server can serve it. Write is for you, not for anyone visiting the site. 644 gives you write access and everyone else read-only.
- A directory needs execute permission so the web server can enter it and find the files inside. Execute on a directory is the right to traverse it, not to run it. Without that bit a directory is unusable no matter what else you set. 755 gives you full control and everyone else the ability to traverse it.
You set permissions while uploading through your FTP client. Most clients have a checkbox or field for it. See our guide on uploading a site with FTP for the client settings.
Why 777 is wrong
777 gives every process on the server full write access to your files. On shared hosting, your neighbour’s account runs on the same machine. If their account is compromised, that attacker can write to your files. If your files are writable by anyone, a compromised script elsewhere on the server can also write to them.
Shared hosts, including CWP free hosting, refuse to run scripts with 777 permissions. PHP itself does not check this — the wrapper that runs it does. On shared hosting your scripts run under suPHP or suEXEC, which run each account’s code as that account and refuse any file writable by group or other. The refusal surfaces as a 500 Internal Server Error, with a line in the error log naming the file. You cannot override this from your account.
The only thing 777 is good for is a place where you truly need any process to write, such as a temporary upload directory during setup. Even then, you change it back to 755 or 644 the moment the setup finishes.
What happens when permissions are wrong
Too few permissions and the web server cannot read your files. The server returns a 403 Forbidden error. The file exists, the path is correct, but the server is not allowed to read it. Changing the file to 644 fixes it. Changing the directory to 755 fixes it.
Too many permissions and the server refuses to run the file. That is the 500 error mentioned above. Some scripts also refuse to run if configuration files are world-writable. The fix is the same: set files to 644, directories to 755.
You can change permissions in your FTP client, in the web file manager on cPanel, or by running the chmod command in a terminal if you have SSH access. On CWP free hosting you do not have SSH. Use the web file manager or your FTP client.
Permissions and security
A compromised site on a shared server can be used to attack other accounts on the same machine. This is not a hypothetical. Malware scans for writable files and writes injected code into them. Your site then serves malware to your visitors. See our acceptable use policy for why this matters for everyone on the server.
Do not make files writable by group or other unless you have a specific reason and understand the risk. Most sites run perfectly on 644 and 755 for years without ever needing a different permission. If a third-party script asks you to use 777, find a different script or ask the developer for a supported alternative.