wp-config.php, with 600 or 640. Never use 777. Change permissions in Files > File Manager: select the item, click Permissions, tick the boxes or type the number, and save.How Linux permissions work
Every file and folder has three sets of permissions, for three kinds of user:
| Who | Meaning on a cPanel account |
|---|---|
| User (owner) | Your cPanel account. PHP also runs as this user on modern cPanel servers. |
| Group | Other users in the file’s group, usually only your account and the web server. |
| World (others) | Everyone else on the server. |
Each set can allow three actions:
| Permission | Number | On a file | On a folder |
|---|---|---|---|
| Read (r) | 4 | View the contents | List the files inside |
| Write (w) | 2 | Change or delete | Create, rename or delete files inside |
| Execute (x) | 1 | Run as a program | Open the folder and reach files inside |
Add the numbers for each set. Read and write is 4 + 2 = 6; read and execute is 4 + 1 = 5; all three is 7. The three digits are user, group and world in that order, so 644 means the owner can read and write, and everyone else can only read.
Recommended permissions
| Item | Permission | Why |
|---|---|---|
| Folders | 755 | The web server can open them; only you can change them |
| Normal files (HTML, PHP, images, CSS) | 644 | Readable by the web server; only you can change them |
| Config files with passwords (wp-config.php, configuration.php, .env) | 600 or 640 | Hidden from other users on the server |
| .htaccess | 644 | Apache must read it |
| CGI scripts in cgi-bin | 755 | They must be executable |
| Anything | Never 777 | Anyone on the server could change the file |
On cPanel servers, PHP runs as your own user through PHP-FPM or a similar handler. Your sites can therefore write to files and folders they own without any world-writable permissions. Many servers refuse to run PHP files that are writable by others, so 777 often causes a 500 error rather than fixing anything.
Change permissions in File Manager
- In cPanel, open Files > File Manager.
- Go to the file or folder and select it.
- Click Permissions in the toolbar (or right-click and choose Change Permissions).
- Tick the boxes, or check the number shown, for example 644.
- Click Change Permissions.
File Manager changes one item at a time. Our File Manager guide covers the other tools.
Change permissions over SSH
If your plan includes SSH access (Security > SSH Access or the Terminal in cPanel), you can fix a whole site at once. Run these from the site folder:
cd ~/public_html
# Folders to 755, files to 644
find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;
# Protect a configuration file
chmod 600 wp-config.php
# Check the result
ls -lThe first column of ls -l shows permissions as letters: -rw-r--r-- is 644 and drwxr-xr-x is a folder with 755.
Ownership matters too
Permissions only work if your account owns the files. Files uploaded or restored by the server administrator can end up owned by root or nobody, and then your site cannot write to them even with the right numbers. In File Manager, the permissions view shows the owner. If files belong to another user, ask support to fix the ownership.
Common errors
| Error | Likely cause | Fix |
|---|---|---|
| 403 Forbidden | A folder is not readable, or a file is 600 but the web server must serve it | Set folders to 755 and public files to 644. |
| 500 Internal Server Error | A PHP file or folder is writable by others (777) | Reset to 644 and 755. |
| The site cannot upload files or update plugins | Wrong ownership, not wrong numbers | Ask support to set the owner to your account. |
For a worked example with a CMS, see our Joomla permissions guide.
Need help with this?
Hosting that runs PHP as your own account, with support that fixes permission problems for you.
Frequently asked questions
What permissions should my website files have?
Folders 755 and files 644. Configuration files with passwords can be 600 or 640.
Is 777 ever safe on cPanel hosting?
No. PHP runs as your own user, so 777 is never needed, and it lets others change your files.
What does 644 mean?
The owner can read and write the file; the group and everyone else can only read it.
Why do I get 403 Forbidden after changing permissions?
The web server can no longer read the file or open the folder. Use 644 for files and 755 for folders.
Can I change permissions for many files at once?
Yes, over SSH with find and chmod, as shown above. File Manager changes one item at a time.
Related guides
