On Linux, every file and directory has permissions that determine who can read, write to or execute them. Incorrect settings can cause two types of error: if permissions are too restrictive, the web server cannot read the files (error 403) or the website cannot be loaded; if permissions are too permissive, a compromised script or another user may be able to modify them.

Three levels of permissions

Each file has three permission categories:

• Owner (u): the user who created the file or to whom it is assigned.
• Group (g): members of the user group assigned to the file.
• Other (others, o): everyone else on the system.

Types of permissions

Each category may have three types of rights:

Legal	File	In the directory	Value
r (read)	Read the content	List of contents	4
w (write)	Editing the content	Creating, deleting and renaming files	2
x (execute)	run as a program	Access the directory	1

In the output of ls -l, the permissions appear as follows, for example: -rwxr-xr--. The first character indicates the type (- file, d directory, l symbolic link), whilst the following nine characters, arranged in groups of three, show the permissions for the owner, the group and other users. The names of the owner and the group are also shown here. On AlmaLinux and Rocky Linux, there is a full stop after the permissions (-rw-r--r--.): this indicates that the file has a SELinux label, which is not part of the permissions. The label is displayed by the ls -Z command (see: SELinux: why am I getting a ‘Permission denied’ error?).

Changing permissions: chmod

By the numbers

The permissions for each of the three categories are represented by a single digit in various formats, which is the sum of the values r, w and x:

chmod 755 mappa
chmod 644 index.php

755 grants the owner full access (rwx = 4+2+1 = 7), whilst the group and everyone else are granted read and execute permissions (r-x = 4+1 = 5). 644 grants the owner read and write access (rw- = 6), whilst everyone else is granted read-only access (r– = 4).

In letters

The letter form amends the existing rights:

chmod u+x szkript.sh     # a tulajdonos futtathatja
chmod go-w config.php    # a csoport és mások írási jogának elvétele
chmod o= titkos.txt      # mások semmilyen jogot nem kapnak

Recommended settings for websites

For websites, the appropriate permissions are usually 755 for directories and 644 for files. Sensitive configuration files (such as wp-config.php) may have stricter permissions (640 or 600) if the web server is running on behalf of the owner. Setting up an entire directory tree:

find /var/www/oldal -type d -exec chmod 755 {} \;
find /var/www/oldal -type f -exec chmod 644 {} \;

Do not use the chmod -R 755 command on the entire directory tree, as this makes files executable: in a test, a .php file became -rwxr-xr-x as a result, but reverted to -rw-r--r-- after running the above find … -type f … 644 command. For many files, the {} + extension is quicker (find /var/www/oldal -type f -exec chmod 644 {} +), as chmod processes multiple files at once.

Changing the owner: chown

The chown command changes the owner and group of a file or directory. This requires root or sudo privileges:

sudo chown felhasznalo:csoport fajlnev
sudo chown -R www-data:www-data /var/www/oldal

The -R switch applies the change recursively to the entire directory tree. The web server user varies by distribution: www-data on Debian and Ubuntu, and apache or nginx on AlmaLinux and Rocky Linux. If you only wish to change the group, you can also use the chgrp command.

Why should you avoid 777?

777 grants full write access to everyone. It is often used as a quick ‘fix’ for an incorrect permissions setting, but this allows any process to modify the files or replace them with malicious code. On cPanel hosting, PHP typically runs as the account’s own user, so 755/644 is more than sufficient there. Permissions can also be changed in the cPanel File Manager; see: Managing files on cPanel hosting. On your own VPS, always set the minimum necessary permissions.