Secure File and Directory Permissions

Setting the right file and directory permissions is essential to prevent unauthorised access to — or modification of — your WordPress site. Incorrect permissions can allow attackers to overwrite files, inject malicious code, or even take full control of your website.

The panel automatically assigns recommended permissions by default. For extra security, we recommend setting wp-config.php to 440.

Recommended permissions

• Files: 644 — The owner can read and write; everyone else can only read.
• Directories: 755 — The owner can read, write, and execute; everyone else can read and execute.
• wp-config.php: 440 — Restricts access to sensitive configuration details.

Tips:

• Never use 777 permissions. This grants write access to everyone and is a major security risk.
• Audit your permissions regularly, especially after installing new plugins or themes.

Correct permissions help WordPress run smoothly while minimising the risk of unauthorised changes.

Advanced: make core files temporarily read-only

Permission 444 makes files completely read-only. In a controlled recovery or investigation window this can prevent changes to core files, but it is not a standard setting for routine WordPress management.

The wp-includes folder contains core libraries that WordPress needs to read and execute — but never modifies during normal operation. By making these files read-only, you prevent malicious code, vulnerable plugins, or compromised admin accounts from injecting or altering core functionality.

Because WordPress and management tools can no longer write to these files, core updates and repairs may fail. Use this only temporarily, with a current backup and a documented rollback.

Do not apply 444 to the wp-includes directory itself. Directories need the execute permission to be accessible. If you accidentally remove it, log in via SFTP and set the directory permissions back to 755.

To set secure permissions across all wp-includes files:

1. Connect using SSH.
2. Go to your main website directory:

   cd public_html

3. Run the following command:

   find wp-admin wp-includes -type f -exec chmod 444 {} \;

Before a WordPress update or repair, return the files to the normal value:

find wp-admin wp-includes -type f -exec chmod 644 {} \;

Then test the website, administration area and update process. If you suspect malware, use file-integrity checks and restore from a known-clean source; changing permissions alone does not remove an infection.

How to edit permissions

You can change permissions on any file or folder by right-clicking it and selecting Permissions from the menu.