How to Fix WordPress File Permissions Issues

Are you getting permission errors when uploading images, installing plugins or updating your WordPress website?

Incorrect file and folder permissions can prevent WordPress from saving files, creating directories or completing updates. They can also introduce security risks if files become accessible to users who shouldn’t be able to modify them.

However, not every WordPress permission error is caused by incorrect permission settings. File ownership, server configuration, storage restrictions and security rules can produce similar problems.

Changing permissions without identifying the cause can make matters worse.

In this guide, we’ll explain how WordPress file permissions work, show you how to check them and walk through the safest ways to resolve common issues.

What are WordPress file permissions?

File permissions control who can read, modify or access files and directories on your server.

On most Linux-based WordPress hosting environments, permissions are managed by the operating system.

They apply to files such as:

• WordPress core files.
• Plugin and theme files.
• Images and other uploaded media.
• Configuration files, including wp-config.php.
• Directories used for uploads, updates and caching.

Correct permissions help WordPress function while restricting unnecessary access.

For example, WordPress needs to save uploaded images inside the appropriate uploads directory. If the process handling the upload doesn’t have the necessary access, the operation can fail.

Similarly, a plugin update may fail if WordPress cannot replace the plugin’s files using the filesystem access method available to it.

File permissions also help protect your website from unauthorised changes.

However, they’re only one part of WordPress security. Keeping WordPress, themes and plugins updated remains essential.

Understanding WordPress file permission numbers

Linux file permissions are commonly represented by three-digit numbers, such as 644 or 755.

Each digit represents the permissions available to a particular category of user.

Position	Applies to
First digit	File or directory owner
Second digit	Members of the owning group
Third digit	Other users

Each digit combines three permission values:

Permission	Value	Meaning
Read	4	Read a file or list directory contents
Write	2	Modify a file or change directory entries, subject to directory access
Execute	1	Execute a file or traverse a directory

These values can be added together.

For example:

• 7 means read, write and execute (4 + 2 + 1).
• 6 means read and write (4 + 2).
• 5 means read and execute (4 + 1).
• 4 means read only.

What does 644 mean?

A file permission of 644 means:

• Owner: Read and write.
• Group: Read only.
• Others: Read only.

This is commonly represented as:

-rw-r--r--

It’s a widely used permission setting for ordinary WordPress files.

What does 755 mean?

A directory permission of 755 means:

• Owner: Read, write and execute.
• Group: Read and execute.
• Others: Read and execute.

It’s commonly represented as:

drwxr-xr-x

For directories, execute permission generally means the ability to traverse the directory, rather than execute it as a program.

The permissions on parent directories also matter. A process may be unable to access a file even when the file itself appears readable.

Why ownership matters

Permissions don’t work independently of file ownership.

Each file or directory has an owner and an associated group.

A process receives access according to its operating system identity and the relevant permission settings.

This explains why two websites with identical permission numbers can behave differently.

One website may work correctly with 755 directories and 644 files, while another may require a different ownership or group configuration.

Changing a permission number cannot automatically correct an ownership problem.

What permissions should WordPress files and folders have?

For many conventional Linux hosting environments, the following are reasonable starting points.

Item	Common permissions
Ordinary WordPress directories	755
Ordinary WordPress files	644
More restricted directories	750, where supported
More restricted files	640, where supported
wp-config.php	Often more restrictive, depending on ownership
Upload and cache directories	Must be writable by the appropriate process

These are examples, not universal requirements.

Your hosting provider may use a configuration in which PHP runs under your website’s account. Alternatively, PHP or the web server may use a different operating system user.

That distinction affects which directories must be writable and by whom.

The official WordPress file permissions documentation explains the different hosting arrangements.

Should you use 777 permissions?

Generally, no.

A permission setting of 777 grants read, write and execute permissions to the owner, group and other users.

This provides far more access than most WordPress files or directories require.

It may appear to fix a problem because it removes important restrictions, but it also creates unnecessary security exposure.

Don’t use 777 as a shortcut for resolving WordPress permission errors.

Instead, identify which process needs access and configure ownership and permissions appropriately.

What about wp-config.php?

The wp-config.php file contains sensitive WordPress configuration information, including database connection details.

It should not be unnecessarily writable or readable by other users on the server.

More restrictive settings, such as 600, 640, 400 or 440, may be appropriate in different environments.

However, choosing a restrictive number without checking ownership can prevent PHP from reading the file, leaving your website inaccessible.

Before changing its permissions, confirm which operating system user or group needs read access.

Consult your hosting provider or the official WordPress security hardening guidance if you’re unsure.

Common signs of WordPress file permissions problems

Incorrect permissions can produce several different symptoms.

The important thing is to establish whether the symptoms are actually related to filesystem access.

403 Forbidden errors

A 403 Forbidden response means that access to a requested resource has been denied.

Incorrect filesystem permissions can cause this, but they aren’t the only possible explanation.

Other causes include:

• Web server access rules.
• Security plugin restrictions.
• Web application firewall rules.
• Incorrect directory configuration.
• Missing or invalid authentication.

If a 403 error appears, inspect the relevant web server and security logs before changing permissions.

Images won’t upload

You may encounter an error when uploading a file through the WordPress Media Library.

If WordPress cannot write to its uploads directory, the upload may fail.

However, uploads can also fail because of file size restrictions, unsupported file types, insufficient storage or image processing problems.

Start by checking the exact error.

Our guides to fixing common WordPress image errors and increasing the WordPress maximum upload size cover those other possibilities.

Plugin or theme updates fail

WordPress needs a supported way to write or replace files when installing or updating software.

If it cannot do so, you might see messages such as:

• Could not create directory.
• Could not copy file.
• Installation failed.
• Update failed.

You might also be prompted for FTP or SSH credentials.

These symptoms can indicate insufficient filesystem access, but they don’t prove that the permission numbers are incorrect.

WordPress may be using a filesystem access method that requires additional credentials or a particular ownership arrangement.

If automatic updates are failing, our WordPress automatic updates troubleshooting guide covers the broader issue.

WordPress can’t create a directory

WordPress and some plugins create directories for uploads, temporary files, cache storage and other operations.

The process creating the directory needs suitable access to its parent directory.

For example, if WordPress needs to create a subdirectory inside wp-content/uploads, the relevant process must have the necessary write and traversal permissions.

An incorrectly owned parent directory can prevent this even when the desired new directory doesn’t exist yet.

Security concerns

Permissions that grant excessive write access can make it easier for another server process or user to modify files.

However, incorrect permissions don’t necessarily mean that your website has been hacked.

Likewise, correcting permissions alone won’t remove malware or address an exploited plugin vulnerability.

If you suspect a compromise, investigate the incident rather than simply resetting permissions.

Before changing WordPress file permissions

Permissions changes can affect your entire website, so it’s worth preparing before making them.

1. Take a recent backup

Make sure you have a reliable backup of the website and its database.

If you’re working with SSH, it’s also useful to record the existing ownership and permissions of anything you intend to change.

A backup of the website alone may not preserve every aspect of server ownership and access configuration.

2. Identify the affected operation

Try to establish exactly what’s failing.

For example:

• Does the problem affect one image or every upload?
• Can WordPress update plugins but not themes?
• Is one directory affected or the entire website?
• Did the problem begin after a migration, restore or hosting change?
• Does the server log report a filesystem permission error?

The more specific the problem, the less likely you’ll need to make broad configuration changes.

3. Check your hosting provider’s requirements

Managed WordPress hosts sometimes use permission and ownership arrangements that differ from common examples.

These configurations may be intentional security measures.

If your provider manages the PHP service, web server or filesystem permissions, ask for its recommended settings before overriding them.

4. Avoid unnecessary bulk changes

Don’t reset every file and directory simply because one operation fails.

You may accidentally remove special permissions, break access to private directories or interfere with your hosting provider’s setup.

Start with the specific file or directory associated with the error.

Method 1: Check permissions using your hosting control panel

For many website owners, the hosting control panel is the easiest place to investigate a permissions issue.

Some providers offer cPanel, while others have their own file management interface.

Step 1: Open File Manager

Sign in to your hosting account and locate the website’s File Manager.

Find the directory containing your WordPress installation.

Depending on your setup, it might be called public_html, htdocs or something else.

If you’re hosting multiple websites, make sure you’re working in the correct site’s directory.

Step 2: Find the affected file or folder

Navigate to the location associated with the error.

For example, an image upload problem might lead you to:

wp-content/uploads/

Select the relevant directory and inspect its permissions.

Also check whether the hosting interface displays the file or directory owner.

Step 3: Compare the existing permissions

If the directory has 755 permissions, that may already be correct.

Changing it to 777 is not an appropriate next step.

Instead, determine whether the user running PHP has write access through ownership or group membership.

If the permissions are clearly incorrect, use your provider’s recommended values.

Step 4: Change only what’s necessary

If you’ve confirmed that a particular directory should have 755 permissions, use the File Manager’s permissions control to make that targeted adjustment.

Avoid enabling recursive changes unless you’ve inspected the contents and understand which files will be affected.

Step 5: Test the original problem

Return to WordPress and repeat the operation that failed.

If an image upload now succeeds, confirm the file appears correctly in the Media Library.

If the problem remains, don’t keep increasing permissions.

The underlying cause may be ownership, server configuration or something unrelated to filesystem access.

Method 2: Check WordPress file permissions using SFTP

If your hosting provider supports SFTP, you can inspect and sometimes change filesystem permissions using a client such as FileZilla.

SFTP transfers files through an encrypted SSH connection and is generally preferable to unencrypted FTP.

Step 1: Connect to your server

Open your SFTP client and connect using the credentials supplied by your hosting provider.

Locate the WordPress installation directory.

Step 2: Inspect the relevant permissions

In FileZilla, you can generally right-click a file or directory and select File permissions.

You’ll see the current numerical permission value and the corresponding read, write and execute settings.

Step 3: Check the appropriate value

For an ordinary directory, 755 is a common configuration.

For an ordinary file, 644 is common.

However, compare the setting with your hosting provider’s requirements before changing it.

An SFTP client may not show everything needed to diagnose ownership or PHP process access.

Step 4: Apply a targeted change

If you’ve confirmed the correct permission value, enter it and apply the change to the affected item.

Be particularly careful with recursive options.

Applying directory permissions to every file can unintentionally add execute permissions to files that don’t need them.

Likewise, applying ordinary file permissions to directories can remove permissions needed to traverse them.

Step 5: Test WordPress

Repeat the failed upload, update or other operation.

If it still fails, investigate ownership and server logs rather than repeatedly changing permission values.

Method 3: Diagnose file permissions using SSH

SSH provides a more detailed way to inspect permissions and ownership.

This method is best suited to website administrators who are comfortable working on a Linux server.

If you’re using managed hosting, confirm that shell access and permission changes are supported.

Step 1: Navigate to your WordPress directory

Connect to the server through SSH.

Navigate to the directory containing your WordPress installation.

Make sure you’re working on the correct website before running any commands.

Step 2: Inspect file and directory ownership

On a typical Linux server, you can inspect the WordPress uploads directory using:

ls -ld wp-content/uploads

The output shows information including permissions, owner and group.

You might see something resembling:

drwxr-xr-x 5 siteuser sitegroup ... wp-content/uploads

This shows the permissions, but it doesn’t establish whether the PHP process can write to the directory.

For more detail, GNU/Linux systems commonly provide the stat command:

stat -c '%A %a %U:%G %n' wp-content/uploads

This displays the symbolic permissions, numerical mode, owner, group and directory name.

You can also inspect an individual file using the same command with its path.

Step 3: Check parent directories

A process must be able to traverse the directories leading to the file or folder it needs.

On Linux systems where namei is available, this can help:

namei -l wp-content/uploads

It displays permissions and ownership information along the path.

This is useful when the uploads directory looks correct but access is blocked by a parent directory.

Step 4: Identify the process that needs access

Determine which operating system user or group is handling the failed operation.

For sites running PHP-FPM, the relevant PHP-FPM worker may run under a dedicated website account.

The Nginx or Apache worker could run under a different account.

An SSH login user may have different access again.

Don’t assume that the web server, PHP-FPM and SSH processes all use the same account.

Your hosting provider or server administrator can confirm the correct execution identity and ownership arrangement.

Step 5: Make a targeted correction

Once you’ve identified the cause, correct only the affected permission or ownership setting.

For example, if an ordinary directory has an incorrect mode and your server configuration requires 755, the relevant command would be:

chmod 755 /path/to/confirmed-directory

For an ordinary file that should use 644:

chmod 644 /path/to/confirmed-file.php

These are examples. Replace the placeholder paths with confirmed locations, and don’t apply either command without checking that the proposed permission is appropriate.

If ownership is wrong, a server administrator may need to correct it.

Changing ownership without knowing which account should own the files can break WordPress updates, SFTP access or PHP’s ability to write files.

Why you should avoid recursive chmod commands

You may encounter tutorials recommending commands that change the permissions of an entire WordPress installation.

Although recursive permission changes have legitimate administrative uses, they can be risky when applied without reviewing the directory structure.

A website may contain private backups, configuration files, symbolic links, cache directories or other resources requiring different settings.

Applying a single permission value everywhere is especially dangerous because files and directories have different access requirements.

For troubleshooting, targeted changes are safer.

If a large-scale correction is necessary, it should be planned, backed up and performed by someone familiar with the server’s ownership model.

File ownership and PHP-FPM: Why correct permissions may still fail

One of the most confusing WordPress permission problems occurs when a directory has apparently normal permissions but WordPress still cannot write to it.

Consider a directory configured with 755.

Only the directory owner has write permission under that mode.

If PHP runs as a different user that isn’t the owner, it may not have permission to create files there.

This is why changing the permission number alone may not solve the problem.

The importance of the PHP execution user

On servers using PHP-FPM, PHP workers can run under a specific user and group.

Some hosts configure a separate PHP-FPM pool for each website.

Others use different arrangements.

The correct ownership configuration depends on how the hosting environment is designed.

Where group-based access is intentionally required, suitable group membership and permissions may be part of the solution.

However, making an entire WordPress installation broadly writable by the web server isn’t a safe general recommendation.

The aim is to give the necessary process access to the specific locations it needs, without introducing excessive permissions elsewhere.

Why WordPress sometimes asks for FTP credentials

WordPress uses a Filesystem API to support file operations across different hosting environments.

Depending on the configuration, it may use direct filesystem access or request credentials for another supported method.

Being prompted for credentials doesn’t automatically mean your file permission numbers are wrong.

It may reflect how WordPress detects filesystem access and ownership.

Avoid forcing a different filesystem access method in wp-config.php without understanding the implications.

You can learn more in the official WordPress Filesystem API documentation.

Special WordPress files and directories to check

Different parts of WordPress have different access requirements.

wp-content/uploads

This directory stores uploaded media.

WordPress needs to be able to create files and, where appropriate, new subdirectories within it.

If uploads fail, inspect the directory and relevant parent paths.

Check both permissions and ownership.

Also verify available disk space and whether security restrictions are preventing access.

wp-content/plugins and wp-content/themes

These directories contain your installed plugins and themes.

Updates may require WordPress to replace or create files within them.

However, they shouldn’t automatically be made writable by every server user.

If an update fails, check the configured WordPress filesystem method and the relevant hosting permissions.

wp-config.php

This sensitive configuration file should only be accessible to the users and processes that genuinely need it.

The correct restrictive permission value depends on the hosting configuration.

Changing it without verifying ownership can stop WordPress from loading.

Cache and temporary directories

Some plugins create their own cache or temporary storage directories.

Their access requirements can differ from those of ordinary WordPress core files.

Always check the relevant plugin documentation before changing permissions.

PHP’s temporary upload directory

PHP normally receives an uploaded file in a temporary location before WordPress processes and moves it.

This location is influenced by PHP’s upload_tmp_dir configuration and the server environment.

It isn’t necessarily located inside wp-content.

If WordPress reports a missing temporary folder, the issue may relate to PHP’s temporary directory configuration, its availability or its permissions.

Changing permissions on wp-content/uploads won’t automatically correct a problem with PHP’s separate temporary storage.

See the PHP upload configuration documentation for details.

When WordPress file permissions aren’t the problem

A permission-related error message doesn’t always mean that a file needs a different numerical permission.

Several other issues can produce similar symptoms.

A web application firewall blocks the request

A firewall can block an upload or administrative action even when the filesystem is correctly configured.

If an operation produces a 403 response, check whether a security rule is responsible.

The upload exceeds the permitted size

A large file may be rejected by PHP, the web server or an upstream proxy.

This requires upload limit troubleshooting, not a filesystem permissions change.

See our guide to increasing the maximum upload size in WordPress.

Your server is running out of storage

If a disk or filesystem quota is full, WordPress may be unable to save files even when permissions are correct.

Check available storage and relevant quotas.

The directory doesn’t exist

A plugin may expect a particular directory to exist.

If it has been removed, the operation may fail.

Before creating a replacement, confirm the required path and which component is responsible for managing it.

A security policy restricts filesystem access

Linux security mechanisms such as SELinux or AppArmor can restrict access independently of ordinary Unix permission bits.

These restrictions need to be investigated through the relevant system configuration and logs.

Changing chmod values won’t necessarily resolve them.

The problem is an application error

PHP errors, plugin conflicts and incompatible software can interrupt uploads or updates.

Check the error logs before assuming that file permissions are responsible.

Common mistakes to avoid

When troubleshooting WordPress file permissions, avoid these approaches:

1. Setting everything to 777. This grants unnecessary access and can create security risks.
2. Changing permissions recursively without inspection. This can overwrite intended restrictions on sensitive files.
3. Changing file ownership blindly. Incorrect ownership can break PHP, WordPress updates and server administration.
4. Assuming 644 and 755 solve every problem. These are common settings, not universal requirements.
5. Confusing WordPress user roles with filesystem permissions. They control different kinds of access.
6. Using a security plugin as a substitute for diagnosing server ownership. A plugin may inspect some settings without being able to correct the actual cause.
7. Ignoring logs. The exact server or PHP error often provides more useful information than the message shown in WordPress.

Where possible, make the smallest change required to restore the intended functionality.

How to verify that you’ve fixed the permission issue

After making a correction, verify the original problem rather than relying only on the updated permission numbers.

Repeat the failed operation

If the problem involved media uploads, upload a suitable test file.

If it involved a plugin update, verify that the update can now complete safely.

If the website previously displayed an error, confirm that the affected page or operation works again.

Check the logs

Review the relevant PHP, web server or WordPress logs.

Confirm that the original permission error has stopped occurring.

A successful operation does not necessarily mean every related issue has been resolved.

Review the final permissions and ownership

Check that the affected files and directories still have appropriately restricted access.

A repair should not leave unrelated files unnecessarily writable.

Confirm normal website functionality

Check important areas of the website, including the WordPress dashboard and any functionality affected by your changes.

If you changed access to a plugin or theme directory, confirm that the relevant software continues to work as expected.

Keep a record of the changes so they can be reviewed or reversed if necessary.

WordPress user roles vs file permissions

WordPress user roles and filesystem permissions are two different access systems.

WordPress roles determine what users can do through the WordPress application.

For example, administrators, editors and authors have different capabilities within the dashboard.

Filesystem permissions determine what operating system users and processes can do with files and directories on the server.

Changing someone’s WordPress role doesn’t automatically change ownership or permissions on the server.

Likewise, changing a directory from 755 to 775 doesn’t grant a WordPress editor additional dashboard capabilities.

For more information about dashboard access, see our guide to managing WordPress user roles and permissions.

Frequently asked questions

What are the correct file permissions for WordPress?

For many conventional Linux hosting setups, ordinary files use 644 and directories use 755.

Some environments use more restrictive settings, such as 640 and 750.

The correct configuration depends on ownership, group membership and the hosting environment.

Sensitive files such as wp-config.php may require different permissions.

Is 755 safe for WordPress directories?

It is commonly used and can be appropriate, provided the directory’s ownership and the wider hosting configuration are correct.

However, 755 doesn’t guarantee that WordPress can write to a directory.

Only the directory owner has write permission under that mode.

Should WordPress files be set to 644 or 755?

Ordinary WordPress files are commonly set to 644.

Directories are commonly set to 755.

Regular PHP files generally don’t need Unix execute permission simply because PHP interprets them.

Applying 755 indiscriminately to files may grant permissions they don’t require.

Can I use 777 to fix WordPress permission errors?

You should avoid doing so.

Although 777 may allow an operation to succeed, it provides unnecessarily broad filesystem access.

Identify the required user, group and directory permissions instead.

Why can’t WordPress create a directory?

The relevant process may lack permission to write to the parent directory.

Other causes include incorrect ownership, missing parent directories, storage restrictions or server security policies.

Check the exact error and relevant logs before changing permissions.

Can a WordPress plugin fix file permission problems?

Some security plugins can check filesystem permission values or provide limited permission-related features.

However, they may be unable to change file ownership or resolve restrictions imposed by the hosting environment.

A role-management plugin also won’t correct Unix filesystem permissions.

For server-level problems, your hosting provider or an experienced WordPress technician is usually better placed to diagnose the cause.

How do I fix WordPress permissions after migrating a website?

Start by checking file ownership and the PHP execution environment on the new server.

The original hosting provider may have used different operating system users, groups or permission settings.

Don’t assume that copying the old permissions will produce the correct result.

Verify the new host’s requirements, then correct the specific ownership or access problems identified.

Need help fixing WordPress file permissions?

WordPress file permission problems can be straightforward when they affect a single incorrectly configured directory.

But if the issue involves file ownership, PHP-FPM, server restrictions or a website migration, changing permission numbers without investigating the cause can create more problems.

At Newt Labs, we help website owners diagnose and repair WordPress issues, including failed updates, upload errors and server configuration problems.

If your website is still experiencing permission errors, our one-off WordPress website repair service can help identify the cause and fix it safely.

For ongoing support with updates, security and website maintenance, explore our WordPress maintenance plans.