WordPress File Permissions Explained: What Do 755, 644, and 600 Mean?

For every WordPress website owner, the terms 755, 644, and 600 are essential, yet often misunderstood, security concepts. These numbers are not arbitrary codes; they are the fundamental language the server uses to determine who is allowed to read, write, or execute your website’s files. Incorrect file permissions are one of the most common causes of website errors, including the dreaded 500 Internal Server Error, and a primary vector for security breaches.

A permission setting that is too loose (e.g., 777) is an open invitation for hackers to inject malicious code. A setting that is too strict (e.g., 400) can prevent WordPress from functioning, leading to update failures or inability to upload images.

Understanding what these three-digit codes mean, particularly the industry standards of 755 for folders and 644 for files, is the single most important step in securing your WordPress installation. This guide will break down the file permission system, explain the standard codes, and show you exactly how and why to apply them to your WordPress site.

Decoding the Permission System: The Triad of Access

File permissions in Linux-based operating systems (which virtually all web servers run on) are based on a simple, three-part system: three permissions applied to three specific groups of users. The resulting three-digit number is the code you see (e.g., 755).

1. The Three Permissions (The Actions)

Permissions define what an account is allowed to do with the file or folder.

Permission	Abbreviation	Numerical Value	Description
Read	r	4	Allows a user to view or open the file’s contents.
Write	w	2	Allows a user to modify, edit, or delete the file’s contents.
Execute	x	1	Allows a user to run the file (essential for scripts, programs, and accessing folder contents).

2. The Three User Groups (The Audience)

These permissions are applied to three distinct categories of users:

Group	Description
Owner	The specific user account that created the file or folder (usually your hosting account username).
Group	Users who belong to the same primary group as the Owner (used in multi-user environments, less critical for single-site owners).
World (or Others)	Everyone else, including the web server software (like Apache or Nginx) that serves your site to the public.

3. The 3-Digit Code (The Sum)

The three-digit permission code is derived by summing the numerical values (4, 2, 1) for each group, in order: Owner $\rightarrow$ Group $\rightarrow$ World.

For example, to get the common permission 755:

• Owner (7): Read (4) + Write (2) + Execute (1) = 7
• Group (5): Read (4) + Execute (1) = 5
• World (5): Read (4) + Execute (1) = 5

WordPress Standard Permissions Explained

WordPress operates best when permissions are applied consistently and according to the principle of Least Privilege—meaning users and processes should only have the minimum permissions necessary to function. The industry standards for WordPress are non-negotiable for security.

1. The Folder Standard: 755 (rwxr-xr-x)

755 is the standard, secure permission for all directories (folders) in WordPress.

User	Permission Sum	Description	Security Rationale
Owner (7)	Read, Write, Execute (4+2+1)	Full control over the folder.	Allows your hosting account to rename, create, or delete folders and files within them.
Group (5)	Read, Execute (4+1)	Can view the contents and navigate the folder.	Allows the web server to access the contents of the folder.
World (5)	Read, Execute (4+1)	Can view the contents and navigate the folder.	Allows the web server to access files and execute scripts within the folder.

Why not 777? Setting a folder to 777 (Read, Write, Execute for everyone) gives any malicious script, bot, or process full write access to the folder. If an attacker finds a way to exploit a script on your server, they can write new, malicious files to your website and compromise your entire system. 777 should never be used on a production website.

2. The File Standard: 644 (rw-r–r–)

644 is the standard, secure permission for all files in WordPress.

User	Permission Sum	Description	Security Rationale
Owner (6)	Read, Write (4+2)	Can read, edit, or delete the file.	Allows your hosting account to manage the file, and enables you to edit files via FTP.
Group (4)	Read (4)	Can view the file’s contents.	Allows the web server to read the content and serve it to visitors.
World (4)	Read (4)	Can view the file’s contents.	Allows the web server to read the content and serve it to visitors.

Why not 666? Setting a file to 666 gives World (Others) write permission. This means if a low-level vulnerability is found, an attacker could potentially modify core PHP files or configuration files without needing full root access. 644 is read-only for the public and server.

3. The Configuration File Standard: 600 (or 400)

600 is the recommended, highly restrictive permission for specific critical files.

• Target Files: Primarily wp-config.php (which contains your database credentials) and sometimes the .htaccess file.
• Permission: 600 means only the Owner has Read and Write permissions. The Group and World have no access (0).

Security Rationale: This prevents even the web server (which runs as “World”) from reading your database username and password. While some hosts require 640 or 440 to allow the server to read the file, 600 is the most secure setting and should be used whenever possible.

How to Apply Permissions via FTP

You will typically use an FTP (File Transfer Protocol) client like FileZilla to view and modify these settings.

1. Connect via FTP: Log into your server using your hostname, username, and password.
2. Navigate to the Root Directory: Go to the folder containing your WordPress installation (e.g., public_html).
3. Change Permissions for Folders (755):
   • Right-click the top-level folders: wp-admin, wp-includes, and wp-content.
   • Select “File permissions” (or similar).
   • Enter 755 in the Numerical Value box.
   • Crucially: Check the box that says “Recurse into subdirectories” and select the option to “Apply to directories only.” Click OK.
4. Change Permissions for Files (644):
   • Select all the files and folders in your root directory.
   • Right-click and select “File permissions.”
   • Enter 644 in the Numerical Value box.
   • Crucially: Check the box that says “Recurse into subdirectories” and select the option to “Apply to files only.” Click OK.
5. Change Permissions for Critical Files (600/640):
   • Locate the wp-config.php file in your root directory.
   • Right-click, select “File permissions.”
   • Enter 600 (or 640 if 600 causes errors). Click OK.
   • Repeat this for the .htaccess file.

Troubleshooting Common Permission Errors

Incorrect permissions can lead to clear error messages. Knowing the symptom can lead you directly to the fix.

Symptom	Probable Cause	Permission Fix
Cannot Upload Media: Image upload fails with an error or 500 error.	The server (World) cannot write to the wp-content/uploads folder.	Set the wp-content/uploads folder (and its subdirectories) to 755.
500 Internal Server Error: Appears when loading the site.	The server is trying to execute a file with dangerous permissions, or the .htaccess file is misconfigured.	Ensure all files are 644 and folders are 755. Set .htaccess to 644 or 600.
Cannot Update Plugins/Themes: Update fails or requires FTP credentials.	The server (World) cannot write to the theme or plugin folders.	Ensure the wp-content/themes and wp-content/plugins folders are set to 755.
Cannot Edit Code via Dashboard: File editor in Appearance menu fails to save.	The server (World) cannot write to the PHP files.	Ensure files are set to 644.

Final Security Summary

File permissions are the gatekeepers of your server. Applying the correct permissions is a foundational security measure that is often overlooked.

• Folders: Always 755 (Read/Write/Execute for Owner; Read/Execute for Group/World).
• Files: Always 644 (Read/Write for Owner; Read-Only for Group/World).
• wp-config.php: Strictest possible, typically 600 or 640.
• Never Use 777: It is a massive security risk and is almost never required on a modern web server.

By adhering to the 755 and 644 standards, you ensure that WordPress has the necessary ability to read and write files, while simultaneously denying write privileges to the public and the web server process itself, creating a secure boundary against the majority of automated threats.