How to fix WordPress file permissions

What this problem looks like

The web server must read WordPress files and write only to wp-content/uploads, cache folders, and upgrade directories. Permissions that are too open let attackers modify PHP. Permissions that are too tight break updates and media uploads.

Never chmod 777 on production. Fix ownership so the PHP user owns wp-content while keeping 755/644 on files.

Step 1: Standard WordPress permission targets

Directories: 755. Files: 644. wp-config.php: 440 or 600 depending on host. wp-content/uploads must be writable by the web server for media uploads.

755 on wp-admin, wp-includes, wp-content directories.
644 on PHP, CSS, and JS files.
600 or 440 on wp-config.php when supported.

Step 2: Fix permissions via SSH

On shared hosting, use File Manager in cPanel, Plesk, or Site Tools. Select wp-content, wp-admin, and wp-includes, then change permissions recursively.

Only run the commands below if you have SSH access to the server. They will not work inside File Manager. Run them from the WordPress root.

bash

find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;
chmod 440 wp-config.php

Step 3: Fix uploads and upgrade folders

If media upload fails, confirm wp-content/uploads is 755 and owned by the web server user. Plugin updates need write access to wp-content/upgrade temporarily.

Step 4: Resolve ownership issues

On VPS servers, set ownership to the PHP user, often www-data or nginx. Only run this command if you have SSH access:

bash

chown -R www-data:www-data /path/to/wordpress

Step 5: Verify updates and uploads work

Upload a test image in Media Library. Run a minor plugin update on staging. If either fails, check host error logs rather than opening permissions to 777.

When to stop DIY and hire help

Permission problems after a hack often hide backdoors in writable directories. BugShield audits file permissions and removes unauthorised PHP at a confirmed fixed price.

Questions answered

WordPress file permission FAQs

Answers about safe permission values, ownership, upload failures, wp-config.php, and repairing access without using 777.

Is 777 ever acceptable?

No on production. It lets any user on shared hosting modify your files. Fix ownership instead.

Why can't WordPress install plugins after migration?

wp-content may be owned by the wrong user from the old host. Ask new hosting to align ownership with the PHP process user.

Should wp-config.php be 400?

400 is ideal if the server still boots WordPress. If the site whitescreens, relax to 440 or 644 per host docs.

Do file permissions affect SEO?

Indirectly. 403 errors and broken assets from wrong permissions hurt crawlability and user experience.

What file permissions should WordPress normally use?

A common starting point is 755 for directories and 644 for files, but the correct values depend on the web-server user and your host's security model.

What is the difference between WordPress permissions and ownership?

Permissions define what the owner, group, and others may do. Ownership defines which system user and group those rules apply to, so correct numbers alone may not restore access.

Can wrong permissions stop WordPress media uploads?

Yes. PHP must be able to create files and folders under wp-content/uploads. Check ownership and the current year and month directories before widening access.

What permissions should wp-config.php use?

Use the most restrictive value your host supports while still allowing PHP to read the file, commonly 400, 440, 600, or 640.

Can I reset all WordPress permissions recursively?

Yes, but apply directory and file rules separately and exclude files that need tighter protection. A single recursive mode can make files executable or directories inaccessible.

When should a developer fix WordPress file permissions?

Get help when ownership is wrong, SSH commands are unfamiliar, several sites share a server user, or permission changes could expose credentials and customer uploads.

Keep troubleshooting

Learn how to fix WordPress file permissions.