Linux File Permissions: A chmod and chown Guide

What do r, w and x mean?

The x permission on folders is easy to overlook: if a folder doesn't have x, the files inside can't be accessed, whatever their own permissions are.

Numeric permissions: 755, 644, 600

Each permission maps to a number: r = 4, w = 2, x = 1. These numbers are added up for the owner, the group and others:

For example, 7 = 4 + 2 + 1 (rwx), 5 = 4 + 1 (r-x), 6 = 4 + 2 (rw-).

chmod: changing permissions

chmod 644 index.php
chmod 755 uploads
chmod 600 .env

You can also use letters. u means the owner, g the group, o others and a everyone:

chmod u+x deploy.sh     # give the owner execute permission
chmod g-w config.php    # remove write permission from the group
chmod o-rwx backups     # remove all permissions from others

You can use -R to change the permissions of a folder together with its contents, but chmod -R 755 makes files executable too. To give folders and files different permissions, find is the better tool:

find /var/www/site -type d -exec chmod 755 {} \;
find /var/www/site -type f -exec chmod 644 {} \;

chown: changing the file owner

sudo chown alex index.php
sudo chown alex:www-data index.php
sudo chown -R alex:www-data /var/www/site

The user:group format changes the owner and the group together. Most permission problems on websites come from files belonging to root, for example when you copy files with sudo or run git clone as root.

The right permissions for website files

On Ubuntu and Debian, Nginx and Apache run as the www-data user; on AlmaLinux, Nginx runs as nginx and Apache as apache. A common and safe layout on your own VPS:

• Files are owned by your user, with the web server's group as the group: chown -R alex:www-data /var/www/site
• Folders are 755 and files are 644.
• Folders the application needs to write to (wp-content/uploads in WordPress, storage and bootstrap/cache in Laravel) get group write permission: chmod -R 775 storage
• Config files that contain the database password (wp-config.php, .env) are 640 or 600.

If you run PHP-FPM as your own user, you don't need group write permission; the files already belong to the user PHP runs as. We cover installing Laravel in our How to deploy Laravel guide and Nginx in our How to install Nginx guide.

On shared web hosting, PHP runs as your account's user, so 755 for folders and 644 for files is enough. You can change permissions from the cPanel or DirectAdmin file manager or from your FTP client; the details are in our FTP vs SFTP article.

Never use chmod 777

777 means every user and every process on the server can change that file. A single compromised plugin on a website can write malicious code into those files. If something only works with 777, the problem isn't the permission but the file's owner; use chown to give the file to the right user. We cover what to do with a site that has been attacked in our Website hacked? What to do guide.

Permissions for SSH files

SSH refuses to use key files if their permissions are too open:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

The private key file on your own computer (~/.ssh/id_ed25519) should also be 600. Also check that the folder and the file belong to your user; an authorized_keys file created as root breaks key-based login.

Fixing the "Permission denied" error

1. Check the file's owner and permissions: ls -l file
2. Check every folder along the path. If a single folder in between doesn't have the x permission, the file can't be accessed. namei -l shows the whole path at once:

namei -l /var/www/site/public/index.php

3. Find out which user the process runs as. The web server, PHP-FPM or a systemd service may be running as a different user from you: ps -eo user,comm | grep -E 'nginx|php|apache'
4. Fix the owner or the permission; don't use 777.

We've collected the basic Linux commands in our Linux commands article.

Special permissions: setuid, setgid and the sticky bit

Sometimes you'll come across four-digit permissions:

• Sticky bit (1777): In folders everyone can write to, such as /tmp, it makes sure users can only delete their own files.
• setgid (2775) on folders: New files created in the folder get the folder's group. It's useful when several users work in the same project folder.
• setuid: Makes a program run with the permissions of the file's owner rather than the user running it. It's used by system programs such as passwd; don't set it on your own files.

File permissions on Nodesty servers

On Nodesty AMD Ryzen 9 9950X VPS and AMD EPYC 7763 VPS plans, you have full root access to set file owners and permissions however you like. If you'd rather not manage a server, PHP runs as your account's user on our web hosting plans; you can change permissions in a few clicks from the cPanel or DirectAdmin file manager.