WordPress File Permissions

WordPress requires specific file and directory permissions to balance security and functionality.

Standard Permissions

| Type | Permission | Octal | |------|-----------|-------| | Directories | rwxr-xr-x | 755 | | PHP files | rw-r--r-- | 644 | | wp-config.php | rw------- | 600 | | .htaccess | rw-r--r-- | 644 |

Apply via WP-CLI or SSH

# Set directory permissions
find /var/www/html/wordpress -type d -exec chmod 755 {} \;

# Set file permissions
find /var/www/html/wordpress -type f -exec chmod 644 {} \;

# Lock down wp-config.php
chmod 600 /var/www/html/wordpress/wp-config.php

Common Mistakes

Setting 777 on any file or directory — never do this on production
Leaving wp-config.php at 644 — tighten to 600
Writable uploads directory with PHP execution enabled — block PHP in uploads via .htaccess

Block PHP in Uploads (.htaccess)

<Directory "/var/www/html/wp-content/uploads">
    <Files "*.php">
        Order Deny,Allow
        Deny from All
    </Files>
</Directory>

After changing permissions, test that the site loads and the WordPress admin is accessible before closing the session.