The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
To change WordPress permissions with an FTP client, connect with SFTP or FTPS, open the site directory that contains wp-config.php, select the affected file or folder, choose File Permissions or CHMOD, enter the mode your host requires, and test the original operation again. A common starting point is 755 or 750 for directories and 644 or 640 for files, but ownership and the web-server configuration determine the correct value.
Do not use 777 as a blanket fix. If the FTP account does not own the path or belong to a group with write access, changing permission bits will not solve the problem; the host must correct ownership or group membership.
What WordPress file permissions control
Unix-style permissions decide who may read, write, or execute a file or directory. The three permission classes are the owner, the owning group, and everyone else. A directory also needs the execute permission to be traversed, so directory modes and file modes are not interchangeable.
WordPress must be able to read its core files and, on some installations, write to specific locations such as the uploads directory, a cache directory, or a plugin-managed folder. The required mode depends on which account owns the files, which account runs PHP or the web server, and whether those accounts share a group. That is why WordPress describes its values as host-dependent rather than universal rules.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Changing a mode changes access bits only. It does not transfer ownership, change the group, repair a broken server configuration, or grant your FTP account authority it does not already have.
Prepare safely before changing anything
Back up both parts of the site
Make a current copy of the WordPress files and a database backup before editing permissions or replacing files. A permissions mistake can block updates or make the site unavailable, while a file replacement can remove custom code. Keep the backup somewhere outside the web root and confirm that you know how to restore it.
Confirm the correct WordPress directory
Do not begin at a random folder such as the account home directory. The correct remote directory is the one containing all four of these items:
wp-config.phpwp-adminwp-contentwp-includes
A host may place that directory under public_html, httpdocs, a domain-specific folder, or another document-root name. If you maintain several sites, verify the domain and document root in the hosting panel first.
Collect the host’s connection details
Ask the hosting provider for the host name, port, username, authentication method, and supported protocol. Prefer SFTP (SSH File Transfer Protocol) or FTPS (FTP over TLS). Plain FTP sends credentials and file data in clear text. WordPress’s Updating WordPress using FTP guidance calls this a security risk because passwords and files are not encrypted during transfer.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Connect with SFTP or FTPS
- Open your FTP client and create a new site entry.
- Choose SFTP when the host provides SSH file transfer. Use the SSH port and the authentication method supplied by the host.
- If SFTP is unavailable, choose FTP over TLS (often shown as explicit FTPS) and confirm the certificate warning only after checking that the host name is correct.
- Enter the supplied username and password, or configure the host’s approved key-based authentication for SFTP.
- Connect and verify that the remote pane shows the expected domain’s files. Stop if you see another site’s directory.
Plain FTP can still appear to work technically, but the connection exposes the credentials and transferred content to anyone able to intercept the traffic. Use it only when the host provides no encrypted alternative and you have evaluated that risk with the host.
Show hidden files before editing dotfiles
Files beginning with a period, such as .htaccess, are hidden by default on many clients. In FileZilla, enable Show hidden files or Force show hidden files from the server or view controls, depending on the client version. Refresh the remote directory after changing the setting. Never create a second file with a similar-looking name because the original dotfile is hidden; select the existing file instead.
Open the permission editor in your FTP client
- In the remote pane, navigate to the WordPress directory identified earlier.
- Locate the exact file or folder involved in the failed operation.
- Right-click it and choose the action labeled File permissions, CHMOD, Set permissions, or a similar command. The wording varies by client.
- Enter the numeric mode supplied by your host. If the host has documented an ownership model, use that documentation to select a least-privilege value.
- Apply the change and wait for the transfer or command result. A successful dialog means the server accepted the request; it does not prove that WordPress can now perform the operation.
- Retry the original action, such as uploading an image, installing a plugin, or running an update.
- If the operation still fails, restore the previous mode if you recorded it and investigate ownership and group membership before trying a broader mode.
How numeric permission modes work
A three-digit mode represents owner, group, and other users, in that order. Each digit combines read (4), write (2), and execute (1). Thus, 6 means read plus write, 5 means read plus execute, and 4 means read only. For a directory, execute means that an authorized user may enter or traverse it.
| Mode | Typical meaning | WordPress use |
|---|---|---|
755 |
Owner can read, write, and traverse; group and others can read and traverse. | Common directory starting point when the host’s ownership model supports it. |
750 |
Owner has full access; the group can read and traverse; others have no access. | More restrictive directory starting point on hosts that use a trusted group. |
644 |
Owner can read and write; group and others can read. | Common regular-file starting point. |
640 |
Owner can read and write; the group can read; others have no access. | More restrictive file starting point where the web process is in the group. |
775 |
Owner and group can read, write, and traverse; others can read and traverse. | May be required for group-writable directories, but only when the host documents that arrangement. |
664 |
Owner and group can read and write; others can read. | May be required for group-writable files in the same documented arrangement. |
400 or 440 |
Read access is limited to the owner, or to the owner and group. | Typical hardened values WordPress gives for wp-config.php when ownership permits. |
777 |
Everyone can read, write, and traverse. | Unsafe blanket setting; do not use it as a routine fix. |
These values are starting points, not promises that every server will work with them. Applying one mode recursively to every file and directory can remove required access or expose sensitive data.
WordPress permission guidance by path
| Path or situation | Starting approach | Important qualification |
|---|---|---|
| Most directories | 755 or 750 |
Use the value that matches the host’s owner and group arrangement. |
| Most files | 644 or 640 |
Do not make all files writable merely because one operation failed. |
wp-config.php |
400 or 440 where supported |
This file contains database connection information and deserves tighter protection. |
| Shared-group setup | 775 directories and 664 files may be needed |
Use only when the host confirms that WordPress and the web server share a writable group. |
| Uploads, plugin, or theme-specific directory | Change only the exact path WordPress must write | Check the plugin or theme’s own documentation for additional directories and required modes. |
WordPress’s official permission guidance warns that a folder or file set to 777 can let an attacker who uploads or modifies code gain complete control of the blog, including its database information and password. The practical response is to narrow the writable path and correct ownership, not to leave the whole installation world-writable.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Apply a change in FileZilla without overreaching
Change one file
Select the file, open File permissions, enter the host-approved mode, and apply it. This is appropriate for a single configuration file, a dotfile, or a specific file that WordPress must replace.
Change one directory
Select the directory and set its mode. If the dialog offers a recursive option, read the choices carefully. A correct directory mode does not imply that every file below it should receive the same mode.
Use recursive controls cautiously
Some clients let you apply a mode to the selected directory, to files below it, to directories below it, or to all descendants. Do not select one blanket value for all descendants. Files and directories normally need different execute and write bits, and sensitive files such as wp-config.php should not be opened simply because a parent directory needs to be writable. If the client cannot apply separate file and directory values, make targeted changes instead or ask the host to perform the operation.
Targeted fixes for common WordPress failures
Media uploads fail
Identify the exact uploads path reported by WordPress or by the server log. Change only that directory to the host’s documented writable mode, then upload a small test image. If the test succeeds, do not propagate the mode to the entire wp-content tree.
Free tools Windows power users keep installed
One-click scans. No signup required.
A plugin or theme will not install
Determine whether WordPress needs to write to the plugin or theme directory, a temporary directory, or a directory created by that extension. Check the extension’s documentation for additional paths. Apply the least-permissive mode that permits the installation and retry it.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
WordPress core updates fail
Do not make all core files writable. Check which path the update process cannot create, replace, or remove. Correct that path, test the update, and return any temporary relaxation to the host’s normal value.
.htaccess cannot be edited
Enable hidden-file display, select the existing .htaccess file, and change only its mode if the host says it should be writable. A missing dotfile and an inaccessible dotfile are different problems; confirm that the file exists before changing permissions.
Why “permission denied” remains after CHMOD
The FTP account is not the owner
Permission bits do not change ownership. If the account you used is neither the owner nor a member of the group with the required write bit, the server can reject the CHMOD request or accept it without giving WordPress the access it needs.
Recommended Free Tools
The PHP or web-server account differs from the FTP account
WordPress may run under a different user. A mode that lets your FTP user upload a file may still prevent the PHP process from writing, or a mode that lets PHP write may expose files to unrelated users. Ask the host which account runs PHP and how it is grouped with your site files.
The host blocks permission changes
Some managed environments restrict CHMOD operations. Use the host control panel or open a support request with the exact path, current owner, group, and requested operation. FileZilla Pro documentation notes that FTP and SFTP can change permissions but cannot change file ownership.
Best Value
- [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
- 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
- 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
- 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
- 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
A parent directory blocks traversal
Even if the target has a writable mode, every parent directory in the path must allow the relevant account to traverse it. Check the path from the document root to the target rather than repeatedly loosening the target alone.
Another control is causing the failure
Disk quotas, read-only mounts, security policies, or a server-side deployment process can produce an error that looks like a permissions problem. If the host confirms that ownership and modes are correct, provide the exact error and path to support instead of escalating to 777.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →FTP client, host file manager, or SSH?
| Method | Encryption | Permission changes | Ownership changes | Recursive and hidden-file controls | Best fit |
|---|---|---|---|---|---|
| Plain FTP client | None; credentials and data are clear text. | Usually available through a CHMOD or file-permissions dialog. | Generally unavailable. | Client-dependent; hidden files may need an explicit display setting. | Only when no encrypted protocol is available and the risk is accepted. |
| FTPS client | FTP protected with TLS. | Usually available. | Generally unavailable. | Client-dependent, with recursive controls varying by application. | Graphical transfers and targeted mode changes on hosts that support FTP over TLS. |
| SFTP client | Encrypted through SSH. | Usually available. | Generally unavailable through the client. | Client-dependent; supports safer encrypted administration. | Preferred graphical method when the host provides SSH access. |
| Host file manager | Protected by the hosting panel’s connection. | Often available with host-specific context. | The host may be able to repair ownership or groups. | Controls and rollback depend on the panel. | Sites where the provider restricts external FTP or offers documented ownership repair. |
| SSH shell | Encrypted through SSH. | Available with the correct account and commands. | May be available to an authorized owner or administrator. | Precise recursive and separate file/directory operations are possible, but mistakes can affect many paths. | Administrators who understand the host’s ownership model and have a tested backup. |
The safest choice is the method that combines encrypted transport with an account authorized to manage the site’s files. A graphical client is not inherently safer than SSH if it is connected over plain FTP or used with excessive permissions.
Verify the result and record what changed
- Refresh the remote directory and confirm that the mode shown by the client matches the value you intended.
- Repeat the exact WordPress action that originally failed, not merely a different upload or file operation.
- Check the site’s front end, administration area, media library, and the affected plugin or theme.
- Review the client transfer log for a server response. “Operation successful” confirms acceptance of the command, while the WordPress test confirms usefulness.
- Record the path, old mode, new mode, date, and reason. This makes rollback possible and prevents a future administrator from widening permissions unnecessarily.
- If the test fails, return the path to its previous mode when safe and contact the host with the recorded details.
Security rules worth keeping
- Use SFTP or FTPS instead of plain FTP whenever the host supports it.
- Protect the backup itself; a backup containing
wp-config.phpcontains sensitive database credentials. - Change only the path that needs access, and use the narrowest mode that works with the documented ownership model.
- Keep
wp-config.phpmore restricted than ordinary content files when the host permits400or440. - Never leave
777in place as a routine solution. - Do not assume that a successful CHMOD changed ownership or fixed the PHP process’s account.
- After a temporary change, restore the normal mode and test again.
A practical decision sequence
Start with the path, not a permission number. Identify the operation WordPress must perform, determine which account performs it, and ask the host which owner and group should control the path. Then use SFTP or FTPS to apply a targeted mode, test the operation, and stop once it works. If it does not work, investigate ownership, group membership, parent-directory traversal, quotas, and host restrictions before increasing access. This sequence resolves the underlying problem without turning the entire WordPress installation into a writable target.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
