Do not automatically run chown -R www-data:www-data on an entire WordPress installation. First identify the exact path that fails, the account running PHP, and the task that needs write access. Keep the site owned by the account used for administration whenever possible, use 755 for directories and 644 for files as a general baseline, and grant the web server write access only to the narrow directory that requires it—often a subdirectory of wp-content.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What the error actually means
WordPress can create an upload, install a plugin, or write a cache only when the operating-system account handling the request can traverse the parent directories and has the required permission on the destination. A message such as “Unable to create directory” is therefore not a WordPress setting by itself. It is evidence that the PHP or web-server process cannot write the particular path named in the error.
As an Amazon Associate I earn from qualifying purchases.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteThe correct owner is determined by your hosting model and workflow. On a typical self-managed server, the site files remain owned by the site or deployment user, while PHP receives narrowly scoped access through a group or a targeted ownership change. On shared hosting, WordPress’s documentation says files should normally be owned by your user account, not by the web-server process (which may be called www-data, apache, httpd, or nobody). A recursive change to the service account can make browser-based updates work while breaking later SSH, SFTP, backup, or deployment tasks.
Diagnose before changing ownership
1. Record the exact failing operation and path
Note whether the failure occurs while uploading media, creating thumbnails, installing or updating a plugin, changing a theme, writing a cache, or performing an automatic core update. Copy the full path from the error. wp-content/uploads, a cache directory, and a plugin directory have different least-privilege solutions; changing the whole installation because one subdirectory is unwritable is excessive.
#1 Best Overall
2. Inspect owner, group, mode, and every parent directory
Run these commands as an administrator, replacing the path with your real installation location:
stat -c '%U:%G %a %n' /var/www/html/wordpress/wp-content/uploads
namei -l /var/www/html/wordpress/wp-content/uploadsstat shows the owner, group, numeric mode, and name. namei -l walks each component of the path, which matters because a process cannot reach a writable child directory if a parent lacks execute (traverse) permission. Also inspect a representative file and the parent wp-content directory; a correct mode on the final directory does not compensate for a blocked parent.
3. Find the account that runs PHP for this site
Do not infer the account from a tutorial written for another distribution. PHP-FPM pools, Apache modules, containers, and hosting panels can all use different users. On a server you control, an initial process listing can help:
ps -eo user,group,comm,args | grep -E 'php-fpm|apache2|httpd|nginx'Confirm the result against the virtual-host or PHP-FPM pool configuration. The account serving one site may differ from the account serving another. On managed hosting, the provider may hide this information or enforce it through ACLs and containers; ask support rather than guessing.
4. Check the effective write test
Once you know the service account, test the exact destination as that user. For example, if the account is truly www-data:
sudo -u www-data test -w /var/www/html/wordpress/wp-content/uploads && echo writable || echo not-writableThis tests the account’s effective access, not merely the bits displayed for your administrator account. If the test says “writable” but WordPress still fails, investigate ACLs, SELinux or another mandatory access control system, read-only mounts, disk space, and the path WordPress is actually using.
Free tools Windows power users keep installed
One-click scans. No signup required.
Understand the permission model
Every file and directory has an owner, a group, and permissions for the owner, group, and everyone else. Directory write permission controls whether entries can be created, removed, or renamed; directory execute permission controls traversal and access to entries. A file being writable does not help if its containing directory is not writable.
| Mode | Typical WordPress baseline | Meaning | Important qualification |
|---|---|---|---|
755 |
Directories | Owner can read, write, and traverse; group and others can read and traverse | General starting point, not proof that a web process should own the directory |
644 |
Regular files | Owner can read and write; group and others can read | Core, plugin, and theme files normally stay non-writable to the web process unless a specific workflow requires it |
WordPress’s hardening guidance uses 755 for directories and 644 for files. These values are a baseline to verify after correcting ownership; they do not override a host’s ACL, SELinux context, container volume, or deployment policy. Tighten permissions as far as your workflow allows, then loosen only the path and time needed for a documented operation.
Restore a safe baseline
If modes have been changed indiscriminately, reset the installation’s directory and file modes, then address ownership separately:
find /path/to/your/wordpress/install/ -type d -exec chmod 755 {} ;
find /path/to/your/wordpress/install/ -type f -exec chmod 644 {} ;Run the commands from a privileged account and substitute the real absolute path. Review the result before testing WordPress. A mode reset does not decide who should own the files, and it should not be used to conceal a wrong owner or a security-context denial.
Choose an ownership model that matches your workflow
| Model | Write scope | Best fit | Trade-off |
|---|---|---|---|
| Site/deployment user owns files | Web server writes only to explicitly required directories | Servers where updates and deployments use SSH, SFTP, version control, or automation | Some browser-based installers require a group or temporary write access |
| Shared administrative/web group | Selected directories writable by members of a controlled group | Teams that need both deployment and PHP access | Group membership and umask must be managed carefully |
| Service account owns a targeted directory | Usually an uploads, cache, or generated-assets directory | Operations that must be performed by PHP and are not edited through SSH | Administrative users may later lack write access unless they are in the group or use elevated privileges |
| Web server owns the entire tree | Whole installation | Only a deliberately designed, isolated workflow where no separate file owner exists | Broad compromise impact and likely conflicts with SSH/SFTP maintenance; not the normal shared-host recommendation |
The deciding questions are: which path must be written, which account performs the write, who must update files later, and what security controls does the host impose? The narrowest model that supports all required operations is preferable.
Fix media-upload and directory-creation failures
Use a targeted change for uploads
For a self-managed server where PHP really runs as www-data, a support example for an upload-only failure is:
sudo chown -R www-data:www-data /var/www/html/wordpress/wp-content/uploadsThis is a context-specific remedy, not a universal WordPress prescription. Before running it, verify all three conditions:
- Account: the PHP or web-server worker is actually
www-data, not another user. - Path: WordPress’s upload location is the directory you are changing, including any year/month subdirectories already created.
- Policy: your host permits ownership changes and the directory is not a mounted or managed volume with a different owner model.
After the change, retain the 755 directory baseline unless your group design requires another mode. Upload a small test image, confirm that WordPress can create its generated sizes, and inspect the resulting owner. If SSH or SFTP maintenance now fails, do not repeatedly recurse another chown; adopt a shared-group or site-owner model instead.
Do not make the whole site writable for one upload
Core files, plugin code, and theme code normally do not need to be modified when a visitor uploads media. Granting write access to the whole tree increases the number of files a compromised process can replace. Keep generated content in its intended directory and leave the rest owned and writable only by the administrative workflow.
Rank #4
Fix plugin, theme, and core update errors
Plugin and theme installation is a different operation from media upload because it creates or replaces PHP code. Decide whether your policy permits updates through the WordPress dashboard. If updates are performed through SSH, SFTP, deployment automation, or a package process, the site owner should retain ownership and the web process should not be given blanket write access.
WordPress’s documented automatic-update behavior performs file operations as the user who owns the files, then sets files to 0644 and directories to 0755. Reassigning everything to the web-server user can therefore create a cycle: the dashboard update succeeds, but the owner can no longer edit or replace files without elevated privileges. Conversely, if PHP cannot write the required content directory, a dashboard installation can fail. Align the owner and group with the workflow you actually use instead of alternating recursive ownership commands.
When an update reports that it cannot create a directory, inspect the exact plugin or temporary directory named in the message. Check its parent traversal permissions, free disk space, available inodes, and whether a previous failed extraction left a directory owned by a different account. Correct only that path, then retry once.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Why chmod 777 is a dangerous shortcut
Mode 777 makes a file or directory writable by every local user and process. WordPress warns that world-writable files can allow a compromised process or another account to modify site code. In the worst case, an attacker can take control of the blog and expose database credentials. A successful upload after setting 777 does not prove the configuration is safe; it only proves that the restriction was removed.
When ordinary modes appear correct, investigate the actual cause instead:
Best Value
- wrong owner or group on the destination or a parent directory;
- missing execute permission on a parent directory;
- an ACL that overrides the displayed owner/group bits;
- SELinux or another mandatory access-control policy denying the operation;
- a read-only container volume, mount, or filesystem;
- disk-space or inode exhaustion.
When permissions look right: SELinux, ACLs, and containers
SELinux denials
On Red Hat-family systems, SELinux can deny PHP access even when owner, group, and mode look correct. WordPress notes that these denials can resemble ordinary permission errors. Check the audit log and the file’s security context before broadening modes or changing ownership. A context correction is safer than disabling SELinux or making the entire tree world-writable.
ACLs and inherited policy
Access-control lists can grant or deny permissions not visible in a basic ls -l listing. If ACLs are part of your server design, inspect them with your administrator’s ACL tools and preserve the intended entries when changing ownership. Removing ACLs blindly can break other sites or deployment accounts.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Containers and mounted volumes
In a containerized deployment, the numeric user and group inside the container must map to ownership on the mounted volume. Changing names to www-data inside the container may not change the host-side numeric ownership. Check the image, PHP process user, volume mount mode, and orchestration security policy before modifying the host path.
Managed hosting: stop before a server-level chown
Managed providers may use separate PHP pools, immutable containers, ACLs, or automated ownership repair. A manual recursive chown can be overwritten or can violate the provider’s security model. WordPress advises managed-hosting customers to consult the host’s documentation or support before changing server configuration. Give support the exact WordPress error, failing path, current owner/group/mode, and the operation that should be allowed. Ask them to restore ownership according to the account and pool assigned to your site.
A practical troubleshooting sequence
| Symptom | Most useful check | Least-privilege response |
|---|---|---|
| Media upload says it cannot create a directory | Confirm the configured uploads path, parent traversal, and PHP account | Grant the PHP account or approved group access only to the uploads tree |
| Plugin or theme installation fails | Inspect the named content directory and temporary extraction path | Align ownership with the chosen dashboard-versus-SSH update workflow |
| SSH/SFTP edits fail after a recursive chown | Check whether files are now owned only by the web account | Restore the administrative owner and use a controlled group or targeted write path |
| Modes are 755/644 but writes are denied | Check SELinux audit records, ACLs, mounts, and disk space | Fix the policy or resource issue instead of using 777 |
| Permissions revert unexpectedly | Check hosting automation, deployment jobs, and container volume behavior | Change the source policy or request the provider’s supported configuration |
Verify the fix and keep it from returning
- Back up the affected directory and record its original owner, group, and modes.
- Apply the smallest ownership or group change that addresses the named path.
- Re-run the effective write test as the PHP account.
- Perform the original operation: upload media, create a thumbnail, install the intended extension, or run the update.
- Check newly created files and directories for expected owner and modes.
- Test the maintenance path used by your team, such as SFTP, SSH, deployment automation, and backups.
- Document the PHP account, writable directories, host policy, and rollback command so the next incident does not trigger a blanket recursive change.
If the operation still fails, restore the recorded state only if it does not reintroduce the original defect, then escalate with the path, process account, modes, security context, and host details. Permission changes can take a site offline, so make one controlled change at a time.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
