{"slug":"wordpress-file-permissions","title":"WordPress File Permissions","tags":["security","hardening","server"],"agent_summary":"Correct file and directory permission settings for WordPress to prevent unauthorized access.","trigger_phrases":["file permissions wordpress","chmod wordpress","755 644 wordpress","secure wordpress files"],"runnable":false,"markdown":"\nWordPress requires specific file and directory permissions to balance security and functionality.\n\n## Standard Permissions\n\n| Type | Permission | Octal |\n|------|-----------|-------|\n| Directories | rwxr-xr-x | 755 |\n| PHP files | rw-r--r-- | 644 |\n| wp-config.php | rw------- | 600 |\n| .htaccess | rw-r--r-- | 644 |\n\n## Apply via WP-CLI or SSH\n\n```bash\n# Set directory permissions\nfind /var/www/html/wordpress -type d -exec chmod 755 {} \\;\n\n# Set file permissions\nfind /var/www/html/wordpress -type f -exec chmod 644 {} \\;\n\n# Lock down wp-config.php\nchmod 600 /var/www/html/wordpress/wp-config.php\n```\n\n## Common Mistakes\n\n- Setting 777 on any file or directory — never do this on production\n- Leaving wp-config.php at 644 — tighten to 600\n- Writable uploads directory with PHP execution enabled — block PHP in uploads via `.htaccess`\n\n## Block PHP in Uploads (.htaccess)\n\n```apache\n<Directory \"/var/www/html/wp-content/uploads\">\n    <Files \"*.php\">\n        Order Deny,Allow\n        Deny from All\n    </Files>\n</Directory>\n```\n\nAfter changing permissions, test that the site loads and the WordPress admin is accessible before closing the session.\n","html":"<p>WordPress requires specific file and directory permissions to balance security and functionality.</p>\n<h2>Standard Permissions</h2>\n<p>| Type | Permission | Octal |\n|------|-----------|-------|\n| Directories | rwxr-xr-x | 755 |\n| PHP files | rw-r--r-- | 644 |\n| wp-config.php | rw------- | 600 |\n| .htaccess | rw-r--r-- | 644 |</p>\n<h2>Apply via WP-CLI or SSH</h2>\n<pre><code class=\"language-bash\"># Set directory permissions\nfind /var/www/html/wordpress -type d -exec chmod 755 {} \\;\n\n# Set file permissions\nfind /var/www/html/wordpress -type f -exec chmod 644 {} \\;\n\n# Lock down wp-config.php\nchmod 600 /var/www/html/wordpress/wp-config.php\n</code></pre>\n<h2>Common Mistakes</h2>\n<ul>\n<li>Setting 777 on any file or directory — never do this on production</li>\n<li>Leaving wp-config.php at 644 — tighten to 600</li>\n<li>Writable uploads directory with PHP execution enabled — block PHP in uploads via <code>.htaccess</code></li>\n</ul>\n<h2>Block PHP in Uploads (.htaccess)</h2>\n<pre><code class=\"language-apache\">&#x3C;Directory \"/var/www/html/wp-content/uploads\">\n    &#x3C;Files \"*.php\">\n        Order Deny,Allow\n        Deny from All\n    &#x3C;/Files>\n&#x3C;/Directory>\n</code></pre>\n<p>After changing permissions, test that the site loads and the WordPress admin is accessible before closing the session.</p>\n"}