WordPress File Permissions That Are Tight Enough But Still Let You Update

File permissions are the security control most often set wrong in both directions. Too loose and any process on the server can modify your site. Too tight and WordPress cannot update itself, so somebody eventually sets everything to 777 to make it work.

What the numbers mean

Three digits for owner, group and everyone else. Read is 4, write is 2, execute is 1, and they add together. So 7 is read, write and execute; 5 is read and execute; 4 is read only.

Value	Owner	Group	Others	Use for
755	rwx	r-x	r-x	Directories
644	rw-	r–	r–	Files
600	rw-	—	—	wp-config.php
777	rwx	rwx	rwx	Nothing, ever

Directories need the execute bit to be traversable, which is why they are 755 and not 644. That is the part people find counter-intuitive.

Setting them

cd /path/to/wordpress

# directories
find . -type d -exec chmod 755 {} \;

# files
find . -type f -exec chmod 644 {} \;

# the config file, tighter
chmod 600 wp-config.php

When updates stop working

If WordPress asks for FTP credentials after you tighten permissions, it is telling you the web server user cannot write to the filesystem. The fix is ownership, not looser permissions.

# check who owns the files
ls -la wp-content/

# check which user PHP runs as
ps aux | grep -E 'php-fpm|apache|nginx' | head

The web server user should own the WordPress files. If it does not, ask your host to correct ownership. Setting directories to 777 to work around this is how sites get compromised by a neighbouring account on shared hosting.

Block PHP execution in uploads

Permissions do not stop a PHP file in your uploads directory from being executed if someone manages to place one there. Block it at the server level:

# Nginx
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
}

# Apache, in wp-content/uploads/.htaccess
<FilesMatch "\.php$">
  Require all denied
</FilesMatch>

There is no legitimate reason for PHP to run from an uploads directory. This single rule neutralises a large class of upload-based attacks.

A quick audit

# anything world-writable
find . -type f -perm -o=w -ls
find . -type d -perm -o=w -ls

# PHP files in uploads
find wp-content/uploads -name "*.php"

Both should return nothing. Anything they do return is worth investigating before you do anything else.

Common questions

What about wp-content and the uploads folder?

Same as everything else: 755 for directories, 644 for files. They need to be writable by the owner, which correct ownership provides.

Should wp-config.php be 400?

600 is the practical choice. 400 removes write access for the owner, which breaks the installer and some update routines.

Do permissions matter on managed hosting?

Less, because the host usually handles them correctly. It is still worth auditing after any migration, which is where mistakes appear.