Incorrect File Permissions Let Hackers Write to Your Files. Correct Permissions Lock Them Out.
WordPress file permissions control who can read, write, and execute files on your server. Set too loosely, hackers can modify your files, inject malicious code, and take over your site. Set too strictly, WordPress cannot update itself, upload images, or install plugins. The correct settings balance security with functionality.
“File permissions are the digital locks on every file and folder in your WordPress installation. Set them correctly and hackers are locked out. Set them wrong and your front door is open.”
Correct WordPress File Permissions
Directories: 755 (owner can read, write, execute; group and others can read and execute). Files: 644 (owner can read and write; group and others can read only). wp-config.php: 640 or 600 — this file contains your database credentials and should be readable only by the owner. .htaccess: 644 — WordPress needs to write to this file for permalink updates. Uploads directory: 755 for the folder, 644 for files within it — WordPress needs to write uploaded images here. How to check and change: Connect to your server via FTP or your hosting file manager. Right-click files and folders to see and change permissions. Alternatively, use a security plugin like Wordfence which scans for incorrect permissions. For professional security hardening, see our WordPress Services page.
“File permissions are a set-and-forget security measure. Set them correctly once and they protect your site forever.”
