Permissions control who may read, write and execute each file. Loose permissions let one compromised script write to everything else.
THE CORRECT VALUES
Folders: 755
Files: 644
Configuration files holding credentials (wp-config.php, .env): 600
Scripts intended to run: 755
NEVER USE 777
777 allows any process on the server to modify the file. If a plugin's documentation tells you to set 777, that documentation is wrong and the plugin should be treated with suspicion. Our server configuration will often refuse to execute such files anyway.
SETTING THEM IN CPANEL
- File Manager, select the folders, click Permissions, set 755, tick "Recurse into subdirectories" and apply to directories only.
- Repeat with 644 applied to files only.
- Select
wp-config.phpor.envon its own and set 600.
SYMPTOMS OF WRONG PERMISSIONS
403 Forbidden on a folder, uploads failing, a 500 error after uploading a script, or an application unable to write its cache.
If uploads still fail after correcting permissions, the file ownership may be wrong. Open a ticket and we will reset it from the server side.
