Secure File and Directory Permissions
Setting the right file and directory permissions is essential to prevent unauthorised access to — or modification of — your WordPress site. Incorrect permissions can allow attackers to overwrite files, inject malicious code, or take full control of your website.
wp-config.php to 440. Recommended permissions
- Files:
644— The owner can read and write; everyone else can only read. - Directories:
755— The owner can read, write, and execute; everyone else can read and execute. wp-config.php:440— Restricts access to sensitive configuration details.
Tips:
- Never use
777. It grants write access to everyone and is a major security risk. - Audit permissions regularly, especially after installing new plugins or themes.
Advanced: make core files temporarily read-only
Applying 444 permissions makes core files completely read-only. This can be useful during a controlled investigation or recovery window, but it is not a safe default for daily management because WordPress updates and repairs may fail.
Use this measure only temporarily, with a restorable backup, a maintenance window and a documented rollback. During an incident, combine it with integrity checks and a restore from a known-clean WordPress source.
444 to the wp-includes directory itself — only to the files inside it. Directories need the execute permission to be accessible. If you accidentally remove it, log in via SFTP and reset the directory permissions to 755. To set secure permissions across all wp-includes files:
- Connect using SSH.
- Go to your main website directory:bash
cd public_html - Run the following command:bash
find wp-admin wp-includes -type f -exec chmod 444 {} \;
Restore normal file permissions before updates or repairs:
find wp-admin wp-includes -type f -exec chmod 644 {} \;How to edit permissions
You can change permissions on any file or folder by right-clicking it and selecting Permissions from the menu.