- Article
- Intermediate
- 2 minutes read
- Reviewed August 4, 2026
File permissions determine which operating-system users can read, write or execute WordPress files and directories.
The correct values depend on hosting architecture, process ownership and deployment method.
Ownership Comes First
Identify which user owns the files and which user runs PHP or the web server.
Permissions that are safe in one architecture can be unsafe or nonfunctional in another.
General Principle
Grant the minimum access required.
WordPress core, themes and plugins normally need to be readable by the application. Selected directories such as uploads may need write access.
Avoid world-writable permissions such as 777.
Updates and Write Access
WordPress can update files directly when ownership and permissions allow it.
Some environments use SSH, SFTP or deployment pipelines instead. Choose one controlled method rather than giving broad write access permanently.
Sensitive Files
Protect:
wp-config.php.- Environment files.
- Private keys.
- Backup archives.
- Database exports.
- Debug logs.
- Deployment credentials.
Sensitive files should not be stored in publicly accessible directories without server protection.
File Editing
Production sites can disable the built-in theme and plugin editors with DISALLOW_FILE_EDIT.
This reduces one path for changing code through a compromised administrator account, although it does not stop other write methods.
Verification
After permission changes:
- Load the frontend.
- Sign in.
- Upload a test file.
- Run a controlled update.
- Check logs.
- Confirm backups.
- Verify that public files remain readable.
- Confirm sensitive files are not exposed.
Frequently Asked Questions
Should every WordPress directory be writable?
No. Write access should be limited to the directories and processes that require it.
Is chmod 777 a valid fix?
It can create serious security risk and should not be used as a general solution.
Continue Learning
Previous: [HTTPS and Secure Connections](/resources/wordpress-manual/security/https-secure-connections/)
Next: [Securing wp-config.php](/resources/wordpress-manual/security/securing-wp-config/)