How to Set File Permissions on Your Hosting Server (chmod)

File permissions on a hosting server control who can read, write, or execute each file and folder on your website. Getting them wrong is one of the most common causes of hacks, 403 errors, and 500 errors.

This guide explains what values to use, how to apply them via cPanel and SSH, and which mistakes to avoid.

What Are File Permissions and How Does chmod Work?

Every file on a Linux server has three access levels: owner, group, and others (the public/web server). For each level there are three possible operations:

• r (read) = 4 — view the file's contents
• w (write) = 2 — modify or delete the file
• x (execute) = 1 — run the file or enter the directory

The chmod command assigns these permissions using a three-digit number. Each digit is the sum of the values above. For example, chmod 755 means:

• Owner: 7 (4+2+1) → read, write, execute
• Group: 5 (4+0+1) → read, execute
• Others: 5 (4+0+1) → read, execute

Recommended Values by File Type

There is no single correct value for everything. The key principle is least privilege: grant only the permissions strictly needed.

Golden rule: never use 777 in production. That value allows any process on the server — including a malicious script — to modify your files.

How to Change Permissions in cPanel (No SSH Required)

If your hosting plan includes cPanel, you can change permissions visually without touching the terminal:

1. Log in to cPanel and open the File Manager.
2. Navigate to the file or folder you want to modify.
3. Right-click → Change Permissions (or select the file and use the button in the top toolbar).
4. Check or uncheck the read/write/execute boxes for each access level.
5. Enable "Recurse into subdirectories" if you want the change to apply to all contents of a folder.
6. Save the changes.

If you work with a reliable provider, agencies like El Enlace offer technical support to configure these settings correctly from day one.

How to Change Permissions via SSH (chmod Command)

If you have SSH access, the terminal is the fastest and most precise method. Some useful examples:

# Change a single file
chmod 644 index.php

# Change a folder and all its contents
chmod -R 755 public_html/

# Only files inside a folder (without affecting subfolders)
find public_html/ -type f -exec chmod 644 {} \;

# Only folders (without affecting files)
find public_html/ -type d -exec chmod 755 {} \;

The -R flag applies the change recursively. Use it carefully: if you run it on your hosting root directory, it affects every file.

Reset WordPress Permissions With a Single Pair of Commands

This two-command combination is the most widely used approach to normalize a WordPress installation after a migration or hack:

find /home/yourusername/public_html -type d -exec chmod 755 {} \;
find /home/yourusername/public_html -type f -exec chmod 644 {} \;

Afterward, run chmod 600 wp-config.php separately to protect your database credentials.

Common Errors and How to Fix Them

403 Forbidden Error

This usually means the web server does not have permission to read the file or enter the directory. Fix: make sure directories have at least 755 and files have 644.

500 Internal Server Error

Sometimes caused by overly permissive permissions on .htaccess or PHP scripts. Check that .htaccess has 644.

Can't Upload Files or Images

The destination folder (e.g., wp-content/uploads) needs the web server user to be able to write to it. On most shared hosting plans, 755 is enough because the PHP user and the file owner are the same account.

For more hosting terms and technical concepts explained clearly, visit the hosting glossary.

Key Takeaways

• File permissions control who can read, write, and execute each resource on your server.
• The recommended values are 755 for directories and 644 for files.
• Never use 777 in production — it creates a serious security vulnerability.
• Protect sensitive files like wp-config.php with 600.
• You can manage permissions visually in the cPanel File Manager or via SSH with chmod.
• The find + chmod combination lets you normalize permissions recursively and safely.

Need hosting that's already configured with secure defaults and Spanish-speaking technical support? Explore El Enlace's hosting plans and get started without the technical headaches.

FAQ

What happens if I set chmod 777 on my hosting?

Any process on the server — including scripts from other users on shared hosting — can read, modify, or delete your files. It is the least secure configuration possible and no reputable provider recommends it for production files.

Do permissions reset when I upload files via FTP?

It depends on your FTP client and server configuration. FileZilla, for example, may assign default permissions on upload. Always check permissions after a migration or bulk file transfer.

Should I worry about permissions on a VPS or only on shared hosting?

Both. The difference is that on a VPS you have full control (including root), so the responsibility is greater. On shared hosting the provider applies certain security restrictions, but the permissions on your files are still your responsibility.

What's the difference between numeric and symbolic chmod?

chmod 644 file.php (numeric) and chmod u=rw,go=r file.php (symbolic) produce the same result. The numeric format is faster to type; the symbolic format is more readable for beginners. Both are valid.

Useful resources

Other providers and guides worth comparing:

• HubSpot
• IONOS
• GoDaddy