WordPress file permissions: 755, 644 and what should be writable

The WordPress hardening guide recommends directories at 755 and files at 644, with the core folders writable only by your own user account. wp-content is the usual exception because the web server needs to write uploads there. wp-config.php should be tighter still.

The baseline

These are the commands the guide gives:

find /path/to/your/wordpress/install/ -type d -exec chmod 755 {} \;
find /path/to/your/wordpress/install/ -type f -exec chmod 644 {} \;

Replace the path with your real install directory. In plain terms, the owner can read and write, and everyone else can only read, and directories can be entered.

What should be writable by whom

The guide says the root directory, /wp-admin/, /wp-includes/ and /wp-content/plugins/ should be writable only by your user account. The root .htaccess is the exception, if you want WordPress to write rewrite rules automatically.

/wp-content/ is different. It should be writable by your user and the web server. The guide adds that themes need web server write access only if you use the built-in theme editor.

Why this matters: if the web server can write to core and plugin folders, any code execution bug in a plugin can become a persistent backdoor edited straight into your files.

Protect wp-config.php

The guide recommends:

• Moving it one directory above the WordPress install. It also notes some experts doubt the benefit of that move.
• Restricting its mode to about 400 or 440 so only you and the web server can read it.
• On Apache, denying web access with a Files block for wp-config.php using Require all denied.

Updates and permissions

The guide notes that automatic updates set files to 0644 and directories to 0755, so your baseline matches what WordPress itself applies.

Trade-offs to know

Stricter permissions can stop one click updates from writing files, depending on how your host runs PHP. If updates fail after a change, check which user owns the files before loosening anything. Do not fix it with 777.

A checklist

1. Apply 755 and 644 across the install.
2. Make core folders writable only by the deploy user.
3. Leave wp-content writable as needed, and nothing else.
4. Restrict wp-config.php.
5. Never use world writable modes.

Quick check

Sources

• Hardening WordPress

Last reviewed: 19 October 2026.