Every hosting-panel warning and deploy script eventually arrives at the same two numbers: 755 for directories, 644 for files. Here is what they actually mean and when to deviate.
Reading a mode digit by digit
A 3-digit octal mode assigns permissions to owner / group / other, in that order. Each digit is a sum: read = 4, write = 2, execute = 1.
| Mode | Owner | Group | Other | Meaning |
|---|---|---|---|---|
| 755 | rwx | r-x | r-x | Owner full; everyone else read + traverse/execute |
| 644 | rw- | r— | r— | Owner read/write; everyone else read-only |
| 700 | rwx | --- | --- | Private directory or script |
| 600 | rw- | --- | --- | Private file (keys, secrets) |
| 777 | rwx | rwx | rwx | Anyone on the machine can modify — avoid |
Build any of these interactively with the Chmod Calculator — toggle the checkboxes or decode an octal string back into flags.
Why 755 for directories
On Unix, execute on a directory means traverse — permission to enter it and reach the files inside. A web server running as a different user needs r-x on your directories to serve files from them. Take away the x and every request under that path 403s.
Why 644 for files
Regular files (HTML, PHP, images, CSS) never need execute — the web server reads them; the interpreter is invoked by the server, not the file. 644 lets the server read while only your account can edit. Scripts you run directly from a shell (./deploy.sh) are the exception — those need the owner execute bit: 744 or 755.
When to go tighter
wp-config.php,.env, private keys → 600- Backup folders, personal scripts → 700
- Password-protected areas: permissions control the filesystem, not HTTP — pair with an .htpasswd file for web-level auth.
The 777 trap
777 “fixes” permission errors by giving every account on the host write access to your files — on shared hosting, that includes other customers’ compromised sites. The error 777 papers over is almost always an ownership mismatch (files owned by root or the wrong user after a migration). Fix with chown, not chmod 777. Step-by-step recovery: Fix WordPress File Permissions.