If WordPress reports “Unable to create directory” or says an uploaded file could not be moved to wp-content/uploads, fix the filesystem access for the PHP/web-server process—not just the number displayed by an FTP program. Start with the failing uploads directory, preserve its current owner, group, and modes, then make the smallest change that lets PHP write while keeping the rest of WordPress protected.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Directory mode 755 and file mode 644 are sensible baselines on many conventional hosts, but they work only when ownership, group membership, ACLs, and the host’s security policy agree. The procedure below separates a filesystem denial from a WordPress account-permission problem and gives you a way to roll back every change.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →What the upload error actually means
When you upload an image, WordPress asks PHP to write a file beneath the configured uploads directory. On a typical single-site installation that is wp-content/uploads, followed by a year and month directory such as wp-content/uploads/2026/10. The PHP process must be able to traverse every parent directory, create the year/month directory when needed, and write the image and its generated sizes.
The permission check is performed by the operating system and web-server stack. An FTP client can display 755 while PHP still lacks effective access because the directory belongs to a different user, the process is outside the listed group, an ACL overrides the mode bits, or a mandatory policy such as SELinux denies the operation. Conversely, changing a mode number may appear to work while leaving an unsafe owner or ACL in place.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Keep two permission systems separate:
- Filesystem permissions: owner, group, mode bits, ACLs, parent-directory traversal, read-only mounts, quotas, and mandatory security policy. These determine whether PHP can create or move the file.
- WordPress user permissions: roles and capabilities such as uploading media or accessing administration screens. These determine whether a logged-in account is allowed to perform an action in WordPress.
A message about a directory or a file move normally points to the first system. A “You are not allowed to access this page” or similar dashboard message can be the second system and will not be repaired with chmod.
Use the exact error to locate the failing checkpoint
| Message or symptom | What failed | First checks |
|---|---|---|
| Unable to create directory | WordPress could not create the year/month directory or another required directory. | Inspect the configured uploads path, every parent directory, and the PHP process owner. Check whether the filesystem is read-only or out of space. |
The uploaded file could not be moved to wp-content/uploads |
PHP received the temporary upload but could not move it into the destination. | Check destination ownership, write and execute permissions, ACLs, and security-policy denials. Confirm that the destination is the path WordPress is actually using. |
| HTTP 403, “permission denied,” or a blank response during upload | The web server, PHP, or a security layer rejected the request. This may be unrelated to Unix mode bits. | Review web-server and PHP logs, WAF/security-plugin logs, SELinux or AppArmor events, and the host’s policy. |
| Media upload succeeds but a normal wp-admin page is denied | Likely a WordPress user/capability, session, plugin, or URL problem rather than an uploads filesystem problem. | Test with a known administrator account, clear a stale session, and inspect the specific dashboard error. Do not broaden filesystem permissions to solve it. |
Preserve access before changing anything
Keep an administrator session open in a separate browser tab. If a permission change prevents PHP from loading, you can still use the existing session and your SFTP, SSH, control-panel, or host-support channel to recover.
- Back up first. A database backup and a copy of
wp-content/uploadsprotect content, while a filesystem snapshot or host backup makes a rollback easier. - Record the current state. Save the owner, group, and mode of
wp-content,wp-content/uploads, and the failing year/month directory. Also note any ACL entries and security labels if your host exposes them. - Change only the uploads path initially. Do not run a recursive permission command against the entire WordPress installation while diagnosing one directory.
- Use an out-of-band access method. SFTP/FTP, SSH, a hosting file manager, or host support is safer than editing core files through a broken dashboard.
On SSH, these commands record the important attributes without modifying them:
stat -c '%A %a %U %G %n' wp-content wp-content/uploads wp-content/uploads/2026/10
namei -l wp-content/uploads/2026/10Replace the year/month path with the directory named in the error. If the directory does not exist, inspect its parent and the path WordPress is configured to use before creating it manually.
Confirm the path WordPress and PHP are using
Do not assume the visible wp-content/uploads folder is the destination. A custom UPLOADS value, a relocated WP_CONTENT_DIR, multisite settings, a symbolic link, or a container mount can point WordPress elsewhere.
- Check
wp-config.phpforWP_CONTENT_DIR,WP_CONTENT_URL, and anyUPLOADSdefinition. Treat those constants as code: make a backup and avoid changing them unless the path itself is wrong. - Use the Media settings screen to see whether a custom upload location is configured. On newer installations the field may not be shown, so the configuration file and server layout remain authoritative.
- If WP-CLI is available, run
wp eval 'print_r( wp_upload_dir() );'from the site directory. The returnedbasedirandpathshow the paths WordPress calculates for the current request. - Resolve symbolic links with
readlink -f wp-content/uploadsand inspect the target’s ownership and mount. In a container, the target may be a bind mount whose permissions are controlled on the host.
Test the exact year/month directory generated by the current date, not just the top-level uploads folder. Existing directories can have different owners or modes from the parent, especially after a migration or an extraction from a backup.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Inspect effective access, not just the mode number
Owner, group, and parent traversal
For a directory, the x bit means “search” or traverse. PHP needs execute permission on wp-content, uploads, and every directory between the site root and the target. A directory that displays 755 is writable only by its owner; a PHP process running as another user must be an allowed group member or receive access through an ACL.
Use the output from stat and namei -l to answer three questions:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
- Who owns the target directory?
- Which group owns it, and is the PHP/web-server account in that group?
- Does that account have the required read, write, and execute rights on the target and execute rights on every parent?
Do not infer the PHP account from the web-server brand. Shared hosting may use a per-site account through suexec or a similar isolation method; PHP-FPM pools often run as a site-specific user; a reverse proxy may hand requests to a separate application container. Ask the host or inspect the pool configuration before changing ownership.
Find the PHP execution account
On a server you administer, process listings and PHP-FPM pool files can reveal the account:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchps -eo user,group,comm | egrep 'php-fpm|apache2|httpd|nginx'
grep -R '^[[:space:]]*user[[:space:]]*=' /etc/php* /etc/php-fpm* 2>/dev/nullThe commands are diagnostic only; paths differ by distribution and a managed host may hide them. Apache or Nginx itself may serve static files while PHP-FPM performs the write, so identify the process that executes PHP rather than assuming the front-end web-server account.
Check ACLs and mandatory security controls
An access control list can grant or remove rights beyond the traditional owner/group/mode display. If available, run:
getfacl -p wp-content/uploads wp-content/uploads/2026/10Look for a named user or group entry and the ACL mask, which can limit the effective rights shown for that entry. On systems using SELinux, inspect the security context with ls -Zd wp-content/uploads wp-content/uploads/2026/10 and review audit events. AppArmor, a host intrusion-prevention product, or a managed-host policy can produce an equivalent denial even when Unix permissions look correct.
Check storage and mounts
A write failure is not always a permission failure. Check the filesystem containing uploads:
df -h wp-content/uploads
df -i wp-content/uploads
mount | grep -E 'wp-content|uploads'A full filesystem, exhausted inode pool, read-only mount, quota, or a disconnected network volume prevents creation or movement. A container may show free space inside the container while the host volume is full or mounted read-only.
Choose the correction for your hosting model
| Hosting model | Typical ownership pattern | Safest first action |
|---|---|---|
| Shared hosting with per-site execution | Your account commonly owns the files and PHP runs as that account, but the host may enforce a policy or wrapper. | Use the host file manager or SFTP to restore the site account as owner and ask support before changing group or ACL settings. |
| PHP-FPM on a server you administer | The FPM pool may run as a site user, while deployment files belong to a release or SSH user. | Confirm the pool’s user and group, then grant that account access through correct ownership, a shared group, or a narrowly scoped ACL. |
| Apache or Nginx with a separate PHP service | The front-end account and PHP account can differ. | Grant write access to the PHP executor, not automatically to the web-server account, and keep static application files non-writable. |
| Container or bind mount | Numeric user and group IDs on the host determine access to the mounted directory. | Inspect the mount and container user IDs; correct the host-side ownership or mount policy rather than applying a blind recursive change inside the container. |
| Managed WordPress | The provider controls ownership, ACLs, PHP users, and mandatory security rules. | Record the failing path and error, then ask support which account runs PHP and which policy is denying the write. |
Apply the smallest safe permission change
Use conventional modes only when the ownership model supports them
For many conventional single-site installations, directories use 755 and regular files use 644. The owner can write; everyone else can read files, and directories remain traversable. These numbers are baselines, not a universal prescription.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
| Object | Common baseline | What it permits | Important qualification |
|---|---|---|---|
| Uploads directory and year/month directories | 755 |
Owner can read, create, delete, and traverse; other users can read and traverse. | PHP must be the owner or an allowed group/ACL subject. The parent directories still need execute permission. |
| Uploaded regular files | 644 |
Owner can modify; other users can read. | Existing files may retain older modes. Do not make every file executable to solve an upload error. |
After recording the current state, a narrowly scoped correction can look like this:
find wp-content/uploads -type d -exec chmod 755 {}
find wp-content/uploads -type f -exec chmod 644 {}
These commands affect only the uploads tree, but they still change every existing item beneath it. If only one directory is failing, begin even more narrowly:
Recommended Free Tools
chmod 755 wp-content/uploads/2026/10Use the year and month that actually failed. If a newly created directory immediately receives the wrong mode, fix the account or the process that creates it rather than repeatedly changing it by hand.
Correct ownership or group deliberately
If PHP is not the owner and cannot write through an approved group, a mode change alone will not help. On a server you control, an ownership correction might be:
sudo chown -R siteuser:sitegroup wp-content/uploadssiteuser and sitegroup are examples; substitute the verified site or PHP-FPM account and its intended group. Do not use the generic web-server account simply because it appears in a process list, and do not change ownership of the whole WordPress tree when only uploads require writes.
An alternative is a shared group. Add the PHP account to the site’s approved group according to your operating system’s account-management procedure, set the directory group, and ensure the group has the needed rights. Group changes may require restarting the PHP service or starting a new login session before they take effect.
Use an ACL when ownership cannot be changed
On systems that support ACLs, a named entry can grant the PHP account access to just the uploads path:
sudo setfacl -m u:phpworker:rwx wp-content/uploads
sudo setfacl -m d:u:phpworker:rwx wp-content/uploadsThe account name and default-ACL behavior vary by system. The first entry affects the existing directory; the default entry influences directories created beneath it. Confirm the result with getfacl, and make sure the ACL mask does not reduce the effective rights. If your host manages ACLs centrally, ask support to apply the change instead of fighting an automatic reset.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Keep parent directories and files appropriately restricted
Granting write access to uploads does not require making wp-admin, wp-includes, themes, or plugins writable. WordPress’s hardening guidance treats core files as writable only by the site owner or, where the hosting model requires it, the HTTP daemon account. Preserve that boundary while repairing uploads.
Why 777 is not a legitimate fix
Mode 777 gives every local account and process read, write, and execute access to the directory. It can hide an ownership mistake, but it also lets a compromised process or account alter or add files there. WordPress warns:
Free tools Windows power users keep installed
One-click scans. No signup required.
“The worst that can happen as a result of using 777 permissions on a folder or even a file, is that if a malicious cracker or entity is able to upload a devious file or modify a current file to execute code, they will have complete control over your blog, including having your database information and password.”
Remove any temporary broad permission immediately and repair the owner, group, ACL, or host policy that caused the denial. Do not leave 777 in place because an upload test happened to pass.
Test the repair without losing wp-admin
Test after each discrete change so you know which correction helped. Use a small, non-sensitive image and keep the administrator session open.
- Upload the image through Media → Add New. Wait for the upload to finish rather than relying on the browser’s progress indicator.
- Open Media → Library and view the attachment. This confirms that WordPress can read the stored file and its generated metadata.
- Open a normal dashboard page such as Dashboard → Home, then visit another admin screen. This catches an unrelated authorization or PHP failure introduced by the change.
- On the server, verify that the file exists in the calculated year/month directory and that its owner, group, and mode match the intended policy.
- Review PHP-FPM, web-server, and security-policy logs at the time of the test. A successful upload with a continuing log denial usually indicates a second path, thumbnail operation, or security rule still failing.
- Repeat with a second small image only after the first test succeeds. Do not use an executable script as a test file.
If the upload works but image thumbnails fail, inspect write access to the same directory for the image-editor process and check whether a security plugin or host policy blocks image processing. The destination still must not be made globally writable.
When 755 still fails
The PHP process is not the owner or group member
With 755, only the owner writes. Verify the real PHP-FPM or application user and compare it with stat output. Correct the owner, approved group, or ACL; do not escalate to 777.
A parent directory blocks traversal
The target can be writable while wp-content or an earlier parent lacks execute permission for the PHP account. The namei -l output identifies the first directory where traversal stops. Fix that single parent with the host’s intended ownership or group policy.
Permissions revert after deployment or backup restoration
A deployment tool, migration archive, control-panel task, or security scanner may recreate directories with a different owner. Compare timestamps and logs, then adjust the deployment process or ask the host to preserve the PHP account and ACL. Reapplying chmod after every deployment treats the symptom, not the cause.
The filesystem or quota is the actual limit
“Could not be moved” can result from a full disk, exhausted inodes, a per-account quota, or a read-only mount. The df, df -i, quota report, and mount status distinguish these conditions from a mode-bit denial. Free space or remount the volume only through the host’s normal procedure.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsSELinux, AppArmor, or a managed security rule denies the write
Mandatory controls can reject a write even when owner, group, and mode are correct. Look for an audit event at the upload time and verify the expected web-content label or profile. On managed hosting, provide the exact timestamp, path, and error to support; changing Unix modes cannot override a provider policy.
The path is a symlink or a container mount
Inspect the resolved target with readlink -f and check the host-side mount. A symlink can lead outside the directory you repaired, while a bind mount can expose host ownership IDs that do not match the container’s names. Correct the target or mount configuration at the layer that owns it.
A plugin, WAF, or PHP limit rejects the request
If the filesystem test is clean but the response is HTTP 403 or the request is rejected before a file appears, inspect security-plugin and web-server logs. Also check PHP upload limits and temporary-directory settings. These are request or runtime failures, not reasons to loosen uploads permissions.
Distinguish a dashboard authorization problem
An account can have perfect filesystem access and still be blocked in wp-admin. Capability checks, a damaged session cookie, a changed site URL, a role-management plugin, or a network-level restriction can produce an authorization message. Signs include a normal Media Library upload from one administrator but a denied dashboard page for another account, or an error that names a capability rather than a directory.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Confirm the account’s role and test a known administrator in a private window. Review recent role or security-plugin changes and the site’s URL settings. Restore WordPress user permissions through WordPress or the database backup—not by changing file ownership or adding write access to core directories.
Roll back safely if admin access changes
Use the recorded state to reverse only the edits you made. For example, restore the original owner and group with chown, then restore the original modes with chmod. Remove any temporary ACL entries with the matching setfacl -x operation, and undo a temporary group membership through the host’s account-management process.
After rollback, verify that the site loads, a normal wp-admin page opens, and the original upload error is still documented. If the site remains inaccessible, stop making recursive changes and contact the host with the saved before-and-after output, exact error text, affected path, and test time.
What to give hosting support
Managed hosts can see controls that a WordPress administrator cannot. Send support:
Free tools Windows power users keep installed
One-click scans. No signup required.
- The exact error text and whether it occurs for all files or only a year/month directory.
- The calculated uploads path and the resolved path if it is a symlink or mount.
- The owner, group, modes, and ACL output you recorded, without exposing passwords or private keys.
- The time of a failed test and the administrator account used.
- Whether Media Library access, a normal wp-admin page, and the front end still work.
Ask which account runs PHP, which account owns the uploads directory, whether ACLs or SELinux/AppArmor rules apply, and whether a container or read-only mount is involved. A host can then fix the policy at its source instead of prescribing a blanket permission change.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
