Set correct WordPress file permissions and ownership

File permissions decide who may read, write and run each file. Too strict, and WordPress cannot upload media or install updates. Too loose, and other processes could change your files, and the server may refuse to run them at all, causing 403 or 500 errors.

Before you start

• Access to cPanel → Files → File Manager, or SSH via cPanel → Advanced → Terminal.
• A basic understanding of the three digits: owner, group and others. 7 = read, write, execute; 6 = read, write; 5 = read, execute; 4 = read.

The correct values

On MdmHost, PHP runs as your own cPanel user thanks to CloudLinux and LiteSpeed's suEXEC model. That means WordPress can write to files owned by you with 644/755; it never needs 777.

Fix permissions in File Manager

1. Open File Manager and go to the site folder.
2. Select a file or folder, click Permissions in the toolbar, enter the value (or tick the boxes) and click Change Permissions.
3. Repeat for items that are wrong. File Manager shows the current value in the Permissions column.

File Manager does not change permissions recursively, so for a whole site SSH is much faster.

Fix permissions over SSH

Open cPanel → Advanced → Terminal and run, changing the path if WordPress is elsewhere:

find ~/public_html -type d -exec chmod 755 {} \;

find ~/public_html -type f -exec chmod 644 {} \;

chmod 600 ~/public_html/wp-config.php

If public_html itself was changed, set it back with chmod 750 ~/public_html.

Ownership

All files should belong to your cPanel user. You cannot change ownership yourself, but you can check it with ls -l. Files owned by nobody or root usually come from an old server setup or a restore. Open a ticket at Support → New ticket and we will reset ownership for your account.

Symptoms of wrong permissions

• 403 Forbidden on the whole site: a folder is 700 or less, or public_html was changed.
• 500 Internal Server Error: a PHP file or its folder is writable by group or others.
• "Unable to create directory wp-content/uploads": the uploads folder is not writable by your user, or ownership is wrong.
• Updates ask for FTP credentials: WordPress cannot write to its own files; check ownership and that folders are 755. You can also add define( 'FS_METHOD', 'direct' ); to wp-config.php once ownership is correct.

Frequently asked questions

Should uploads be 777 so plugins can write?

No. 755 is enough because PHP runs as you.

Can stricter permissions improve security?

wp-config.php at 600 is a good idea. Making all files read-only (444) blocks updates and gives little extra protection, since an attacker with your user's access can change permissions back.

Next steps

• WordPress security hardening
• Fix a 500 internal server error
• Clean up a hacked site