By Hridoy Ahmed | Last updated: October 2026 | 6 min read
Short answer: The commonly recommended WordPress file permissions are 755 for folders, 644 for files and a stricter setting such as 440 or 400 for wp-config.php. Never use 777, which lets anyone write to a file. Permissions control who can read, write and run files on your server, so wrong settings can let malware spread. Your host’s guidance comes first, because some servers need different values.
In this guide
What permissions mean
Each file and folder has three groups: the owner, the group and everyone else. Each group can read, write or execute. The numbers show the combination. For example, 644 means the owner can read and write, and others can only read.
Recommended values
- Folders: 755
- Files: 644
- wp-config.php: 440 or 400, if your host allows it
- Never: 777 on anything
These values follow common WordPress guidance. Some hosts use different owner setups, so check with your host if something stops working.
How to change them
- Back up your site.
- Connect with FTP or use your host’s file manager.
- Right-click a folder or file and choose File permissions.
- Enter the number. Apply to folders and files separately, not all together.
- Test the site, uploads and updates.
This is one step in a full WordPress security checklist. For safe hardening by an expert, see my WordPress security service.
Common mistakes
- Setting 777 to “fix” an upload error, which opens a risk
- Applying 644 to folders, which can break the site
- Leaving wp-config.php readable by everyone
- Changing permissions without a backup
- Thinking permissions alone make a site safe
FAQ
What are the correct WordPress file permissions?
755 for folders and 644 for files are common, with a stricter setting for wp-config.php.
Why is 777 dangerous?
It lets anyone write to the file, so malware can modify it.
Why can I not upload files after changing permissions?
The web server may not be able to write to the uploads folder. Ask your host for the right owner and values instead of using 777.
Do file permissions stop hackers?
They reduce risk but do not replace updates, strong passwords and a firewall.
Can a plugin set permissions?
Some security plugins check them. Review the changes before you accept.
Not sure if your server is set up safely? I will review and fix it. See my WordPress security and malware removal service.
About the author: Hridoy Ahmed is an SEO specialist and WordPress security expert based in Dhaka, Bangladesh. He has 8+ years of experience and works with clients worldwide.