WordPress File Permissions, Correctly
The numbers that work, why 777 is never one of them, and what to check after an incident.
Permissions decide who can read and write your files. Getting them wrong is how a single upload flaw becomes a permanent backdoor.
The defaults that work
- Directories: 755
- Files: 644
- wp-config.php: 400 or 440
- .htaccess: 644
Ownership matters as much as the numbers: files should be owned by the account that runs PHP, not by root, and not by a different user than the web server.
Why 777 is never the answer
It means anyone on the system, including any other compromised site on shared hosting, can write to your files. When a plugin upload or permissions error is “fixed” with 777, the actual problem — wrong ownership — is still there, now with the door open. If an upload only works at 777, ask your host to correct ownership instead.
The uploads directory
wp-content/uploads must be writable, which makes it the natural target for a web shell. Configure the server so PHP is not executed inside it. On Apache, an .htaccess in that directory denying PHP execution is the standard approach; on nginx, a location block does the same job. This single change defeats a large share of file-upload exploitation.
After an incident
- Look for files with unexpected recent modification times, especially in uploads and inside plugin directories.
- Check for PHP files anywhere they should not exist.
- Reset permissions and ownership across the tree rather than fixing individual files.
- Then find the entry point — see cleanup.
Hardening reduces the damage. Patching removes the hole. Scan your site free to see what still needs patching.
