Every file and folder on the server has three digits that say who can read, change or run it. With the right digits, the website works and an attacker has less room to move. With the wrong ones, either the website shows “403 Forbidden”, or any script can overwrite your files.
What you'll achieve
- understand what 644, 755 and 777 mean;
- check and fix permissions from Enhance;
- protect
wp-config.phpand the image folder of a WordPress website.
What the numbers mean
The three digits are, in order, for the owner (your website's user), the group and others. Each digit is a sum: 4 = read, 2 = write, 1 = execute (for folders: enter the folder).
| Digits | Used for | What it means |
|---|---|---|
| 644 | files | you read and write; everyone else can only read |
| 755 | folders | you enter, read and write; everyone else can enter and read |
| 640 or 600 | files with passwords, for example wp-config.php | only you (and the group, with 640) can read them |
| 777 | — | anyone can read, write and execute. Never use it |
On NBT Host, files uploaded from Enhance or via FTP usually get 644 and 755 automatically. Problems appear after a plugin that changes permissions, after an archive extracted from another server, or after the “set it to 777 and it works” advice found on a forum.
Before you start
- Back up the website: in Enhance, on the website page, the “Backups” tab » “Create backup” (with the language set to “English (US)”, “Backup now”).
- We use the English names from the Enhance interface, exactly as they appear on screen. If the panel opens in another language, switch it to English from the top right: “My account” » “Language”.
The steps
A. Check the permissions
- In Enhance, open “Websites”, then the website and the “Files” tab.
- Right-click a file or folder » “Get info”: you see the permissions, the owner and the modification date.
- Check especially
public_html,wp-config.php,.htaccessand thewp-contentandwp-content/uploadsfolders.
B. Fix the permissions
- Right-click the file or folder » “Permissions (CHMOD)”.
- Set 644 for files and 755 for folders.
- For a folder, check “Apply recursively” only if you know that everything in it should have the same digits. Don't apply 755 recursively to a folder with files: the files would get execute permission for no reason.
- Open the website and check that it works.
C. Protect wp-config.php
wp-config.php holds the database password and the WordPress security keys.
- Set its permissions to 640. Open the website: if it works, you can also try 600. If an error appears, go back to 644 and write to us.
Add the rule below to the
.htaccessinpublic_html. It refuses any direct browser request for the file, without interfering with WordPress:<Files wp-config.php> Require all denied </Files>You edit the
.htaccessfile from the “Files” tab: right-click » “Edit”, then “Save” (the steps are in Redirect to HTTPS and www).
D. Stop PHP from running in the image folder
Uploaded photos and documents go into wp-content/uploads. PHP code should never run there, but an attacker who manages to upload a file puts it exactly there.
- In the “Files” tab, go into
wp-content/uploads. - Create the
.htaccessfile with “New file”, open it with “Edit” and put this in it:<FilesMatch "\.(?i:php|phtml|phar)$"> Require all denied </FilesMatch> - Save and check that the images on the website still show. Images are not affected: the rule only blocks PHP files.
Some plugins keep their PHP files in uploads. If a plugin stops working after you add the rule, remove it and send us the plugin's name.
What not to do
- Don't set 777, not even “just for a minute”. If a plugin needs 777 to work, that's a problem with the plugin.
- Don't change the files' owner with tools found on the internet. On the hosting, files belong to your website's user, and PHP runs as that same user.
- Don't leave old copies in
public_html(backup.zip,site-vechi.sql,wp-config.php.bak): anyone who guesses their names can download them from a browser.
If something doesn't work
- The website shows “403 Forbidden”. A file or folder has permissions that are too tight, for example 700 on a folder. See Error 403 Forbidden: why it appears and how to fix it.
- The website shows “500 Internal Server Error” after you edited
.htaccess. There's a typo in the rule you added. Delete the new lines, save and try again (see Error 500 Internal Server Error and the blank page). - WordPress can no longer install plugins or updates. A folder in
wp-contentisn't writable. Set it to 755. - Permissions keep going back to 777 or other values. It could be a plugin, or a sign of malware. See How to tell if your website has malware.