iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
For a typical Ubuntu WordPress installation, start with 0755 for directories and 0644 for files. Make the files belong to a dedicated site or deployment user, give the PHP/web process read access, and add write access only to the directories that need it—usually a narrowly scoped part of wp-content. Protect wp-config.php with an owner-only or owner-and-group-readable mode such as 0400 or 0440. Do not “fix” errors by making the entire site 0777.
The exact ownership must match your Ubuntu layout. A single-site server, a server hosting several customers, and a VPS using a per-site PHP-FPM pool should not all use the same account. The procedure below identifies the effective users first, then repairs permissions without granting the web server unnecessary control.
Free tools Windows power users keep installed
One-click scans. No signup required.
What the normal WordPress permission baseline looks like
Unix permissions answer two different questions: who owns a path, and what the owner, group, and everyone else may do with it. WordPress’s hardening guidance is to lock permissions down and loosen them only for a function that genuinely needs write access.
| Path or object | Typical mode | Why |
|---|---|---|
| Directories throughout the WordPress tree | 0755 |
The owner can read, write, and enter the directory; the web process and other permitted users can read and traverse it. |
| Ordinary files | 0644 |
The owner can modify the file; the web process normally needs only to read it. |
wp-config.php |
0400 or 0440 |
Only the owner, or the owner and an intentional group, can read database credentials and salts. |
| Required writable locations | Only as open as the operation requires | Uploads, updates, or a particular plugin may need write access; do not make unrelated core files writable. |
Whole site set to 0777 |
Unsafe | Every local user and compromised process could alter the files, enabling code injection or tampering. |
Modes are not a substitute for ownership. A file with mode 0644 is writable by its owner, not automatically by PHP. Conversely, assigning the whole tree to the web account may let a vulnerability in one site modify code that should be controlled by an administrator.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Before changing anything: identify the real path and users
“Permission denied” often means the command was run against the wrong document root or the PHP worker is not the account you expected. Confirm both before using chown or chmod.
Confirm the virtual-host document root
Inspect the enabled Apache virtual-host file or the root directive in Nginx and write down the directory that actually contains wp-admin, wp-includes, and wp-content. For the examples below, that directory is /var/www/wordpress; substitute your real path.
Recommended Free Tools
Check that you have the intended tree:
sudo ls -la /var/www/wordpress
sudo test -f /var/www/wordpress/wp-config.php && echo "WordPress root confirmed"Find the account serving PHP
On a simple Ubuntu installation the account is often www-data, but per-site PHP-FPM pools and hardened deployments commonly use a separate user. Check the running processes:
ps -eo user,group,comm,args | egrep 'apache2|php-fpm|nginx'For PHP-FPM, inspect the pool configuration rather than relying on the process name. Pool files are commonly under /etc/php/:
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
sudo grep -R --line-number -E '^(user|group|listen.owner|listen.group)s*=' /etc/php/*/fpm/pool.d/The account that executes PHP must be able to traverse every parent directory, read WordPress code, and write only to the directories you intentionally opened. If you use a socket, also verify the socket’s owner and group; a correctly permissioned WordPress tree cannot compensate for a PHP-FPM socket that the web server cannot access.
Back up and record the current state
Permission changes are reversible only if you know what changed. Make a current backup of the database and files, and capture ownership and modes for the root, configuration file, and content directory:
sudo tar -czf /root/wordpress-before-permissions-$(date +%F).tar.gz -C /var/www wordpress
sudo stat -c '%A %a %U:%G %n' /var/www/wordpress /var/www/wordpress/wp-config.php /var/www/wordpress/wp-contentDo not store the backup inside the web root. If a permission change makes the site unreadable, restore the previous ownership and modes from this record while you investigate the specific path.
Reset the common 0755/0644 baseline
From the confirmed WordPress root, reset directories and files separately. The separate passes prevent a directory from accidentally receiving a file mode or vice versa:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
sudo find /var/www/wordpress -type d -exec chmod 755 {} ;
sudo find /var/www/wordpress -type f -exec chmod 644 {} ;This is a baseline, not a declaration that every directory must remain writable by PHP. It makes core code readable and traversable while leaving modification to the owner. Run it only against the intended WordPress tree; a typo in the path can alter an entire server subtree.
After the reset, inspect representative paths:
sudo stat -c '%A %a %U:%G %n'
/var/www/wordpress
/var/www/wordpress/wp-admin
/var/www/wordpress/wp-content
/var/www/wordpress/index.phpChoose an ownership model deliberately
There is no single ownership command that is safe for every Ubuntu VPS. Compare the account that owns files, the account that executes PHP, the directories that need writes, and whether unrelated sites share a user or group.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match| Deployment model | How it works | Security and operations trade-off |
|---|---|---|
| Web-account-owned single site | www-data owns the WordPress tree and PHP runs as www-data. |
Simple updates and uploads, but a compromised web process has broad control. Suitable only when the server’s isolation requirements are low and the tree contains no other maintainers’ sites. |
| Site user with web group access | A deployment user owns files; the PHP/web account is placed in an intentional group or receives narrowly scoped access. | Administrative control remains with the site user, while selected directories can be writable by PHP. Group membership and directory traversal must be configured correctly. |
| Separate site user and per-site PHP-FPM pool | Each site has its own Unix user and a PHP-FPM pool running as that user. | More configuration, but one site’s PHP process cannot normally modify another site’s files. This is the strongest choice for a multi-site VPS. |
Ubuntu documentation specifically warns that making a multi-site tree owned by www-data can be insecure when different sites have different maintainers. Do not run chown -R www-data:www-data across a server merely because it resolves one upload error.
Applying ownership for a single-site layout
If PHP-FPM intentionally runs as the same dedicated site user that owns the files, set ownership to that user and group:
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
sudo chown -R siteuser:siteuser /var/www/wordpressReplace siteuser with the account configured for that site’s PHP-FPM pool. Reapply the 0755/0644 baseline afterward if the ownership operation was part of a larger migration, then verify that the pool can read the files.
Keeping a deployment owner while allowing a web group
When the PHP process is deliberately in a site-specific group, assign that group only where needed. For example, the deployment user can own the tree while the pool’s group is sitephp:
sudo chown -R deploy:sitephp /var/www/wordpress
sudo find /var/www/wordpress -type d -exec chmod 755 {} ;
sudo find /var/www/wordpress -type f -exec chmod 644 {} ;This leaves the group with read and traverse access under the baseline. Add group write permission only to a directory that has a documented requirement, and verify that no unrelated site uses the same group.
Grant write access only where WordPress needs it
wp-content is the normal exception because media uploads are written below wp-content/uploads, and some plugin or theme operations create files there. Start with the smallest failing directory. A plugin’s documentation may identify a more specific subdirectory; follow that requirement instead of opening all of wp-content.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Uploads in a web-account-owned content directory
If the PHP pool intentionally runs as www-data, one controlled approach is to make only the uploads directory belong to that account:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo chown -R www-data:www-data /var/www/wordpress/wp-content/uploads
sudo find /var/www/wordpress/wp-content/uploads -type d -exec chmod 755 {} ;
sudo find /var/www/wordpress/wp-content/uploads -type f -exec chmod 644 {} ;This gives the owner write access while retaining the usual directory and file modes. Do not extend the same ownership to the whole WordPress tree on a multi-site VPS.
Plugin or theme updates
Automatic updates may need temporary or persistent write access to wp-content/plugins, wp-content/themes, or another plugin-specific directory. First identify the exact operation that fails. Grant access to that directory only, perform the update, and remove unnecessary write access afterward if your deployment process permits it. Core directories outside wp-content should remain owned by the deployment account and non-writable by PHP unless a clearly documented maintenance task requires otherwise.
Protect wp-config.php after the change
wp-config.php contains database credentials, authentication keys, and other secrets. WordPress commonly recommends 0400 or 0440; Ubuntu’s per-site-user example uses 400 when the PHP process can read the file as its owner.
sudo chown siteuser:siteuser /var/www/wordpress/wp-config.php
sudo chmod 400 /var/www/wordpress/wp-config.php
sudo stat -c '%A %a %U:%G %n' /var/www/wordpress/wp-config.phpUse 0440 instead when PHP is intentionally a member of the file’s group and must read it through that group. Test the site immediately after tightening the mode. If PHP cannot read the file, correct the owner/group relationship rather than changing the entire tree to a more permissive mode.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
Retest the failed operation in a controlled way
- Open the WordPress dashboard and perform one representative action: upload a small media file, install the affected plugin, or apply one update.
- Check the exact target path’s owner and mode with
stat, for examplesudo stat -c '%A %a %U:%G %n' /var/www/wordpress/wp-content/uploads. - Confirm the PHP-FPM pool user from its configuration and compare it with the target directory’s owner/group.
- Review the web server and PHP-FPM error logs for the complete path that was denied. A denial on a parent directory is different from a denial on the final file.
- Change only the named directory or ownership relationship, then repeat the single test. Do not use
0777as a diagnostic shortcut.
Diagnose common permission failures
| Symptom | Likely cause | Targeted correction |
|---|---|---|
| Media upload says it cannot move the file | The effective PHP user cannot write to wp-content/uploads, or a year/month subdirectory was created with the wrong owner. |
Check the pool user and the exact uploads path; grant write access only to that directory and its required descendants. |
| Plugin installation fails while core pages work | wp-content/plugins is readable but not writable, or the plugin requires a private subdirectory. |
Read the plugin’s stated requirement and open only the required path, preferably for the duration of the installation. |
| Changing modes did nothing | The PHP process runs as a different user than assumed, or a parent directory blocks traversal. | Inspect the PHP-FPM pool, then run namei -l /var/www/wordpress/wp-content/uploads to examine every parent component. |
The site returns an error after hardening wp-config.php |
PHP is not the owner and is not in the file’s read-enabled group. | Use the site-user pool model, or set an intentional owner/group-readable mode such as 0440; do not make the file world-readable. |
| One site can alter another site’s files | Several sites share a broad www-data-owned tree or the same writable group. |
Separate site users and PHP-FPM pools, then move write access to site-specific directories. |
| Updates work but deployment overwrites permissions | A release or synchronization process recreates files with its own owner and mode. | Make the deployment step set the intended ownership and baseline after each release, and recheck writable directories. |
A repeatable least-privilege checklist
- Confirm the actual document root contains the intended WordPress installation.
- Identify the account executing PHP; do not assume it is
www-data. - Back up the database and files and record current ownership and modes.
- Reset directories to
0755and files to0644in the correct tree. - Keep ownership with a site or deployment user whenever the hosting layout supports it.
- Give PHP write access only to the required uploads, plugin, theme, or documented application directory.
- Set
wp-config.phpto0400or an intentional0440arrangement and verify that PHP can read it. - Retest one failing action, inspect the exact denied path, and make the smallest further change.
- Never use blanket
0777permissions or recursivewww-dataownership on a multi-site server.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
