Guide SSL & Security

How to set safe file permissions

The two numbers that cover almost every case on a website: 755 for folders, 644 for files, and why 777 always creates a worse problem.

iFastHosting Support Team Updated 26 August 2026 7 min read Intermediate

File permissions decide who is allowed to read, write to, or run each file and folder on your hosting account. Set correctly, they are a quiet layer of protection that limits what a single compromised file or script can actually do. Set carelessly — most commonly by making something more open than it needs to be to solve an immediate error — they can turn a minor problem into a much bigger one.

Reading a permission number

A permission setting like 755 or 644 is three digits, one each for the owner of the file, the group it belongs to, and everyone else. Each digit is a total built from read (4), write (2) and execute (1):

Digit	Meaning
7	Read + write + execute (4+2+1)
6	Read + write (4+2)
5	Read + execute (4+1)
4	Read only

So 755 means the owner gets read, write and execute, while the group and everyone else get read and execute only. 644 means the owner gets read and write, while everyone else gets read only, with no execute permission for anyone.

The two numbers that cover almost everything

Folders: 755. The owner can read, write and enter the folder; everyone else can view and enter it, but not create or delete anything inside it directly.
Files: 644. The owner can read and edit the file; everyone else can read it, but not modify it.

This combination is correct for the large majority of what makes up a typical website — page content, images, stylesheets, most configuration files. Folders need the execute bit so they can be entered and listed; ordinary files do not need to be executable to be served correctly by a web server.

Never use 777

777 grants read, write and execute to the owner, the group, and everyone else — every account and process on the system, without exception. It is sometimes reached for as a quick fix when something reports a permission error, but it removes the protection permissions exist to provide in the first place. A file writable by literally anyone is a file a compromised script, or anything else running on the shared environment, can also write to.

Checking and changing permissions

Most control panel file managers show the current permission for each file and folder and let you change it directly through a simple interface, without needing to use a command line. Over FTP, most clients show and let you edit permissions the same way, usually by right-clicking a file and looking for a permissions or attributes option.

If you do have command-line access, chmod sets the permission directly:

chmod 644 filename.php
chmod 755 foldername
chmod -R 755 foldername    # recursively, for every file and folder inside

Be careful with the recursive flag

Applying -R across a whole site sets every file and folder underneath to the same value, which is not usually what you want — a recursive 755 applied to files as well as folders leaves files executable when they should not need to be. Apply folder and file permissions separately if you need to correct a large number at once, rather than one blanket recursive command.

When something more restrictive is genuinely needed

A small number of files hold particularly sensitive information — most commonly a configuration file containing database credentials. Some platforms and hosting environments support restricting such a file further, for example to 640 or even 600, removing read access for anyone but the owner entirely. Whether this is appropriate, and whether it will actually work correctly, depends on how your specific hosting environment runs your application — check your platform's own documentation for that particular file before changing it, since setting a configuration file too restrictively can stop your own application from being able to read it.

If you inherited a site with permissions already wrong

A site migrated between hosts, or one that has had permission errors "fixed" with progressively looser settings over time, is worth auditing rather than assumed correct. Check folders for anything set to 777 first, since that is both the most damaging setting and the easiest to search for using a file manager's sort or filter options, then work through files more broadly, correcting anything found back to the 755 and 644 baseline.

How this fits into a wider security setup

Correct permissions do not stop a determined attacker who already has valid credentials, but they meaningfully limit what a single compromised file, plugin, or script can reach if it is exploited — the difference between one file being affected and that file being able to write anywhere on the account. Pair this with the other layers covered in this section: strong passwords, two-factor authentication, and keeping software updated, so permissions are one part of a considered setup rather than the only thing standing in the way.

Frequently asked questions

Why does everyone say never use 777?

777 grants every user on the system full read, write and execute access to a file or folder, including any account or process that should never have had access at all. It is sometimes used as a quick fix for a permission error, but it removes the protection permissions exist to provide, and a file made writable by everyone is a file an attacker can also write to.

What should I do if I am not sure what a file's permissions should be?

Start from 755 for folders and 644 for files, which is correct for the overwhelming majority of website content, and only deviate for a specific documented reason, such as a particular file your application explicitly requires to be more restrictive still.