Fix WordPress file and folder permission errors

WordPress needs the web server user to read (and sometimes write) specific files. If permissions are too tight, updates, uploads, and plugin installs fail. If they are too loose, attackers have an easier time changing PHP on disk.

These permissions are server filesystem rules (owner / group / others). They are not the same thing as WordPress user roles inside wp-admin.

Recommended defaults

Path	Type	Typical permission
Directories (folders)	dir	755
Most files (.php, .css, .js, etc.)	file	644
wp-config.php	file	440 or 400 when the host allows (otherwise 644)
.htaccess (if present)	file	644

Meaning of the digits (owner, group, others):

• 4 = read, 2 = write, 1 = execute (for directories, execute means “enter”)
• 7 = read+write+execute (4+2+1)
• 5 = read+execute
• 4 = read only

So 755 on a directory: owner full access, group and others can enter and list. 644 on a file: owner can edit, everyone else can read.

Never set 777 on WordPress directories to “make the error go away.” That lets any local user (and often the whole server environment) write your PHP.

Common mistakes

• Setting wp-includes or other directories to 644 (directories need execute bits; use 755)
• Recursing 755 onto files inside a folder (PHP files should stay 644)
• Making wp-config.php world-writable

Exact ownership (www-data, nginx, your cPanel user) depends on the host. Shared hosting often wants files owned by your account with the permissions above.

Method 1: cPanel File Manager

1. Log in to cPanel → File Manager.
2. Open the site root (public_html, www, or the domain’s document root).
3. Select WordPress folders, use Permissions, set 755. Prefer fixing top-level dirs (wp-admin, wp-content, wp-includes) and only recurse directories if your File Manager can apply “directories only.”
4. Select files (not folders), set 644.
5. For wp-config.php, try 440/400 if updates and the site still work; otherwise leave 644 and ask the host what they recommend.
6. Clear any server/opcode cache if the host has one, then retry the update.

Method 2: FTP / SFTP (FileZilla and similar)

1. Connect with the host’s SFTP (prefer) or FTP credentials.
2. Right-click a directory → File permissions → numeric 755.
3. If you recurse, choose apply to directories only when the client offers it. Do not apply 755 to all files.
4. For files, set 644 (recurse files only if available).
5. Double-check wp-config.php.

CLI equivalent on a shell host you control (run from the WordPress root, as the correct user):

find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;
chmod 440 wp-config.php  # or 400 / 644 per host policy

Only run bulk chmod if you understand ownership on that server. Managed WordPress hosts may reset permissions on deploy.

If updates still fail

• Disk quota full
• Wrong Linux owner/group (not just mode bits)
• Security plugins or host WAF blocking file writes
• DISALLOW_FILE_MODS set in wp-config.php
• SELinux/AppArmor policies on VPS installs

Permission fixes solve “cannot create directory” / “unable to write” class errors. They do not replace updates, strong logins, or malware cleanup. Broader hardening: WordPress hardening guide.