The reliable WordPress permission baseline on an Ubuntu VPS is 0755 for directories and 0644 for files, with ownership assigned deliberately to the site or deployment account. Give the PHP/web process write access only to the directories that need it—normally a controlled part of wp-content—and protect wp-config.php with a mode such as 0400 or 0440 (400 in a per-site-user setup). Do not “solve” upload or update errors with blanket 0777 permissions.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What the standard permissions should be
WordPress recommends locking the installation down as far as practical and relaxing restrictions only when a specific operation requires writing. The common starting point is:
As an Amazon Associate I earn from qualifying purchases.
| Object | Typical mode | Purpose |
|---|---|---|
| Directories | 0755 |
The owner can read, write and traverse; the group and other users can read and traverse. |
| Regular files | 0644 |
The owner can read and write; the group and other users can read. |
wp-config.php |
0400 or 0440 |
Only the intended owner, or owner and group where explicitly required, can read database credentials and salts. |
| World-writable content | 0777 |
Unsafe as a blanket setting because any local account or compromised process may alter the files. |
These numbers describe mode bits, not ownership. A file can show 0644 and still be unusable if PHP cannot traverse one of its parent directories, or if the account that must write it is neither the owner nor in the owning group. Treat mode and ownership as one design decision.
Why ownership matters as much as chmod
Ubuntu commonly runs Apache or PHP-FPM as www-data, but that is only a default. A VPS may use a separate PHP-FPM pool for each site, a deployment account, or another service user. Confirm the effective account instead of copying a command from a different server.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
There are two broad arrangements:
| Arrangement | File owner | PHP execution account | Security and administration trade-off |
|---|---|---|---|
| Simple single-site deployment | A site or deployment user, sometimes with a shared web group | www-data or the configured web account |
Easy to operate, but the web account may receive broader control if ownership and group write access are made too permissive. |
| Isolated multi-site deployment | A different site user for each site | A PHP-FPM pool running as that site user | More configuration, but one compromised site has less opportunity to modify another site’s files. |
Whole tree owned by www-data |
www-data |
www-data |
Convenient for automatic updates, yet potentially insecure on a server hosting multiple sites or maintainers. |
Canonical’s Ubuntu guidance specifically cautions that making a complete multi-site tree owned by www-data can be insecure. The right scheme depends on who deploys files, which account executes PHP, and whether sites share users or groups.
Before changing anything: identify the path and account
Permission repair is safest when you know exactly which WordPress directory is served and which process is failing. A virtual host may point to /var/www/example, /srv/www/example/current, or another path; changing a similarly named directory will not fix the live site.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsConfirm the document root
Read the active Apache virtual-host configuration or the Nginx server block and record its document root. If PHP-FPM is used, note the pool associated with that site. Do not assume that the directory shown in a deployment script is the one currently serving requests.
Find the effective PHP/web user
Check the Apache worker account, Nginx-to-PHP-FPM configuration, or the pool’s user and group settings. A per-site pool may intentionally differ from www-data. Also check whether a command-line update is being run as your login user while browser requests run as PHP; those are separate permission paths.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Back up and record the current state
Take a database and file backup before changing ownership or modes. Save the current owner, group and mode of the failing path with stat or a directory listing. A mistake in a parent directory can make the entire site unreadable, and a backup gives you a way back.
Safe baseline reset for a WordPress tree
After substituting the real document-root path, these are the command forms documented by WordPress for resetting ordinary directories and files:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo find /path/to/wordpress -type d -exec chmod 755 {} ;
sudo find /path/to/wordpress -type f -exec chmod 644 {} ;The first command affects every directory below the root; the second affects every regular file. They do not set ownership and they do not make uploads writable by themselves. Run them only against the intended WordPress tree, not the whole /var/www hierarchy or the operating system.
Some applications store executable scripts outside the normal web tree, and a deployment may intentionally use a different mode for a particular file. Review those exceptions before applying a bulk reset. The 0755/0644 pair is a baseline, not permission to ignore a documented application requirement.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Set ownership deliberately
Choose ownership based on the way the site is administered:
- For a single site, keep files owned by the site/deployment user and place the PHP account in a deliberately chosen group if group access is needed.
- For multiple sites, use separate site users and, where practical, separate PHP-FPM pools. This limits cross-site access when one application is compromised.
- If you intentionally use a web-owned tree, understand that a compromised web process can then modify more of the installation. Do not apply
chown -R www-data:www-dataacross a server with unrelated sites merely because an update failed.
When changing ownership, use the narrowest path possible and inspect the result. A recursive chown can also change ownership of backups, deployment metadata or a sibling site if the path is wrong.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Grant write access only where WordPress needs it
WordPress needs to write uploaded media beneath wp-content/uploads. Some plugin and theme operations also create or replace files in wp-content, but requirements vary by operation and by plugin. Start with the smallest directory that produces the failure.
Uploads
Make the effective PHP user—or an appropriate group—able to traverse wp-content, create directories in wp-content/uploads, and write files there. Test by uploading one small image, then inspect the resulting path and owner. Do not make the entire WordPress root writable when only uploads are failing.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Plugin and theme installation
Automatic installation may need a temporary write location and, depending on the package, a specific subdirectory under wp-content/plugins or wp-content/themes. Read the plugin’s documented requirement and grant access to that path rather than pre-emptively opening every directory. If the operation works only after making all of wp-content writable, narrow the setting again and identify which subdirectory actually needed it.
Group-based access
A site user plus a web group can avoid making the web account the owner, but group membership and group-write bits must be consistent. Ensure every parent directory is traversable by the effective account, and avoid adding broad write permission for “other” users. A group design is useful only when you can explain which accounts belong to it and why.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Protect wp-config.php after testing readability
wp-config.php contains database credentials, authentication keys and other secrets. WordPress commonly recommends 0400 or 0440, while Ubuntu’s per-site-user example uses chmod 400 unless there is a reason to permit group reading.
cd /path/to/wordpress
sudo chmod 400 wp-config.phpUse 0400 when the account that owns the file is also the account that must read it. Use 0440 only when the configured PHP process intentionally reads it through the owning group. Immediately load the site and perform a harmless administrative request; if PHP reports that it cannot read the configuration, restore the least-permissive owner/group-readable mode that matches your process model rather than opening it to everyone.
Diagnose “permission denied” without using 777
Media upload fails
- Verify the upload directory shown under WordPress’s media settings is inside the expected document root.
- Check each parent directory for execute (traverse) permission by the PHP account.
- Inspect the owner and mode of
wp-content/uploadsand its year/month subdirectories. - Confirm disk space, quotas and read-only mounts; a full filesystem can look like a permissions problem.
- Grant write access to the upload path only, then retry one upload.
Plugin or theme installation fails
- Determine whether WordPress is attempting direct filesystem access or asking for FTP credentials. The prompt can indicate that PHP cannot write the target directory.
- Check the temporary extraction directory and the destination under
wp-content. - Read the exact PHP/web error log path and identify the denied pathname; do not infer it from the screen message alone.
- Inspect the plugin’s documented writable directory before changing broader ownership.
Updates work in SSH but not in the dashboard
Your shell command may run as the deployment user, while the dashboard runs as PHP. Compare the two accounts and their groups. A successful command-line update does not prove that the web process has the required access.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteThe site returns a 403 or 500 after a change
Check the web-server and PHP-FPM logs first. A missing execute bit on a parent directory, an unreadable wp-config.php, or ownership changed on the wrong path can prevent WordPress from starting. Restore the recorded owner and mode for the affected path, then make one targeted change at a time.
Verify the repair safely
- Check the document root and effective PHP account again; configuration may have changed during troubleshooting.
- Inspect the root,
wp-content, the upload directory andwp-config.phpwithstatornamei -lto see every parent directory. - Confirm ordinary directories are 0755 and ordinary files are 0644 unless a documented exception exists.
- Confirm the PHP account can read the application and write only the selected content directory.
- Perform one representative action: upload one image, install or update one known-safe plugin, or save one setting that creates a file.
- Review the created file’s owner and mode, then remove any temporary broad write access.
- Repeat the test after a service restart if PHP-FPM pools or group membership were changed; processes may need to restart before they see new configuration.
Common mistakes and their safer alternatives
| Mistake | Why it causes trouble | Safer approach |
|---|---|---|
chmod -R 777 on the site |
Every local user and compromised process can modify code and configuration. | Reset to 0755/0644, then grant a specific write path to the effective PHP account. |
chown -R www-data:www-data on a multi-site server |
One web account gains ownership across sites with different maintainers. | Use per-site users and pools, or a narrowly scoped group arrangement. |
| Changing only the failing leaf directory | PHP still cannot traverse an unreadable parent directory. | Inspect every component of the path with namei -l or equivalent. |
Making all of wp-content writable permanently |
Plugins and uploads gain more write surface than they need. | Use the documented subdirectory, test the operation, and remove unnecessary write access. |
Locking wp-config.php without testing |
PHP may lose read access and the site may fail immediately. | Apply 400 or 440 according to the owner/group model, then test a page and an administrative request. |
A practical permission policy for an Ubuntu VPS
Document four facts for each site: the file owner, the account that executes PHP, the directories that must be writable, and whether any users or groups are shared with another site. Revisit the policy after migrations, PHP-FPM changes and deployment-tool changes. Permission problems often return when a new pool runs under a different account or when a restore recreates files with a backup user’s ownership.
Keep backups outside the web root, retain a record of deliberate exceptions, and monitor unexpected changes in wp-content. Least privilege is not a one-time chmod command; it is the practice of giving each process exactly the access its documented job requires.
Frequently Asked Questions
Should every WordPress file be owned by www-data?
No. Ownership should match your deployment and PHP process model. A site user with a per-site PHP-FPM pool provides stronger separation on a multi-site VPS; making a whole multi-site tree www-data-owned is potentially insecure.
Is 0777 ever an appropriate permanent WordPress setting?
No blanket 0777 setting is appropriate. If one operation needs writing, identify its exact directory and grant the effective PHP account the narrowest required access.
Why does a permission fix sometimes fail even when the target directory is writable?
The PHP account may be unable to traverse a parent directory, the dashboard and shell may use different users, or the filesystem may be full or mounted read-only. Inspect the complete path and the exact error log entry.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
