WordPress chmod Calculator

What chmod 644 and 755 mean

A mode like 644 is three digits, one each for the owner of the file, the group it belongs to, and everyone else on the server. Each digit adds up read (4), write (2) and execute (1). So 6 is read and write, 5 is read and execute, 4 is read only, and 7 is all three. On a folder, execute means you can enter it, and write means you can add or remove things inside it.

The letter form you see in ls -l says the same thing: -rw-r--r-- is 644, drwxr-xr-x is 755 on a directory.

WordPress file permissions: 755 folders, 644 files, 440 wp-config.php

WordPress's own hardening guide and Chapter 4 of Protect My WP land on the same numbers, and the presets above match them.

• Folders 755. Includes wp-admin, wp-includes, wp-content and uploads.
• Files 644. Every PHP, CSS and JavaScript file, images in uploads, and .htaccess on Apache.
• wp-config.php 440, or 400 if the PHP user owns the file. It holds your database password and salts, and nothing on the server needs to write to it once the site is set up. WordPress creates it as 644, which its own documentation calls a hazard to leave in place. If your host needs the owner to edit it, 640 is the fallback.

Two things the numbers alone don't fix. PHP execution should be blocked in uploads regardless of its permissions, and ownership matters as much as mode: files should belong to the user PHP runs as, usually www-data, never root. If your deploy user and PHP user differ, you may see 775 and 664 suggested. That works, but the better route is to put the deploy user in the PHP user's group and keep the standard numbers.

777 is never right. If a plugin or a host tells you to use it, WordPress's advice is to ask why.

The wp-config.php constants

WordPress sets permissions itself when it writes files during core, plugin and theme updates. FS_CHMOD_DIR and FS_CHMOD_FILE tell it what to use, and the block above follows the folder and file values you pick. They exist because updates used to fail on hosts that default every file to 400. WordPress's reference writes them as ( 0755 & ~ umask() ), which also honours the server's umask; the plain octal form does the job on most hosts. Either way the leading zero is required and the value is not quoted.

DISALLOW_FILE_EDIT removes the plugin and theme editor from the dashboard, which is the first thing an attacker reaches for after logging in. DISALLOW_FILE_MODS goes further and blocks installs and updates from the dashboard too, so only use it if you deploy another way.

How this tool works

Nothing leaves your browser. Tick the bits or type a number, pick whether it is a folder, a file or wp-config.php, and copy the command. The find form applies it to everything under the path in one go.

Read any command before you run it, check the path is your WordPress root and not something wider, and try it on staging first. Permissions are quick to change and quick to get wrong, and the book's warning applies here as much as anywhere: never paste a command you don't understand.