iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The safest web-server permission design gives application code a controlled owner, shares publishing access through a dedicated group, and grants the web-server process write access only to directories that genuinely need it. Use chown or chgrp for ownership, chmod for mode bits, umask for defaults, and POSIX ACLs for narrowly scoped exceptions. Then test access as every relevant account and configure web-server authorization separately from filesystem permissions.
This guide uses Linux command examples. Service-account names, configuration paths, mandatory-access-control labels, and command options vary by distribution and release, so confirm your operating-system and Apache or Nginx version before applying changes.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsStart with an access plan
Permissions are easier to secure when each identity has one clear job. List the people, services, and automated jobs that touch the site before changing a file.
Inventory every identity
- Administrators: named human accounts that maintain the server. Do not share a personal login.
- Deployment accounts: a CI/CD account or controlled release user that publishes builds.
- Web-server account: the account running Apache, Nginx, or another HTTP service. Common names include
www-data,apache, ornginx, but the actual name is distribution-specific. - Scheduled jobs and workers: backup, queue, image-processing, upload, and cache tasks may need different access.
- Log writers: the service that writes logs should not automatically gain access to application source.
Give each identity only the access it needs. A deployment user normally needs to replace or create release files, but not unrestricted sudo. The web process normally needs to read code and write selected runtime data, not modify scripts or configuration.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Choose a layout before choosing modes
Separate immutable code from mutable data. A practical layout might contain a release directory for application code, a shared directory for uploads and generated cache, and a log directory managed by the service or operating system. This prevents a compromised web process from rewriting the code it executes.
| Area | Typical owner | Typical writers | Security objective |
|---|---|---|---|
| Application code and configuration | root or a controlled release owner | deployment process only | Web process can read but cannot alter executable code. |
| Uploads | root or deployment owner | web process or upload worker | Keep user content outside script directories and validate file types. |
| Cache and runtime state | service account or dedicated group | the component that generates it | Grant write access only to the required path. |
| Logs | service or logging account | the process that emits logs | Prevent application users from replacing or truncating system logs. |
Create a purpose-specific group
A POSIX group is the normal way to share read, write, or execute access among named users. Create a group for publishing rather than making the entire web root writable by everyone.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Create the group and add members
Run these commands as root or through an approved administrative mechanism. Replace names with your own deployment account and group.
groupadd webdeploy
usermod -aG webdeploy deploy
usermod -aG webdeploy webmasterThe -aG form appends the group; omitting -a can replace a user’s supplementary groups. Ask the user to start a new login session, or use newgrp webdeploy for a temporary shell, before expecting the new membership to appear.
Confirm membership
getent group webdeploy
id deployDo not add the web-server account to this group merely for convenience. Add it only when the application has a documented requirement for shared writes, and prefer a separate data group when possible.
Set ownership deliberately
Ownership determines which permission class applies. Set the owner and group explicitly instead of inheriting whatever account happened to unpack a release.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
chown -R root:webdeploy /var/www/example/current
chgrp webdeploy /var/www/example/shared/uploads
ls -ld /var/www/example /var/www/example/current /var/www/example/shared/uploads
namei -l /var/www/example/current/index.htmlUse chown owner:group path when both values must change and chgrp group path when the owner should remain untouched. Inspect every parent directory with namei -l; a file can have correct mode bits while an ancestor blocks traversal.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Be cautious with recursive ownership changes. A single command over an entire web tree can accidentally give a service account control of configuration, private keys, or deployment metadata. Scope commands to the intended release or data directory and keep a rollback record.
Understand owner, group, and other bits
Linux stores separate read (r), write (w), and execute (x) bits for the owner, group, and everyone else. Numeric values add read = 4, write = 2, and execute = 1.
| Mode | Meaning | Common use |
|---|---|---|
0644 |
Owner reads and writes; group and others read. | Ordinary public document or asset that must not be edited by readers. |
0755 |
Owner reads, writes, and executes; group and others read and execute. | Directories that must be traversed, or executable programs that are intentionally runnable. |
2775 |
Group-writable directory with the setgid bit; new entries inherit the directory’s group. | A controlled collaboration directory where every publisher belongs to one group. |
0777 |
Read, write, and execute for owner, group, and others. | Almost never appropriate for a web root; investigate the real access failure instead. |
Files and directories are not interchangeable
A regular file normally needs read permission to be served. It usually does not need execute permission. A directory needs execute permission to be traversed and searched, even when the file inside is readable. Directory read permission controls listing names; it is separate from traversal.
Free tools Windows power users keep installed
One-click scans. No signup required.
Do not run one recursive chmod value over every object. Set directory and file modes independently:
find /var/www/example/current -type d -exec chmod 0755 {} +
find /var/www/example/current -type f -exec chmod 0644 {} +For a collaborative publishing tree, use a group-oriented mode only where collaboration is required:
chown -R root:webdeploy /var/www/example/releases
find /var/www/example/releases -type d -exec chmod 2775 {} +
find /var/www/example/releases -type f -exec chmod 0664 {} +Review whether every file should really be group-writable. A deployment process can often build a release elsewhere and switch a symlink, avoiding in-place edits to a live tree.
Use setgid directories for group inheritance
The setgid bit on a directory causes newly created files and subdirectories to inherit that directory’s group instead of the creator’s primary group. It does not automatically make new files group-writable; the creating process’s mode and umask still apply.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
chgrp webdeploy /var/www/example/shared
chmod 2775 /var/www/example/shared
ls -ld /var/www/example/sharedTest the actual deployment tool. Some programs preserve a different mode, replace directories, or create temporary files outside the setgid path. Confirm the resulting owner, group, and mode after a staging deployment.
Control defaults with umask
A process starts with a base mode of 0666 for regular files and 0777 for directories; its umask removes permission bits. A commonly documented default is 0022, which yields 0644 files and 0755 directories.
umask
umask 0022A publishing team may use 0002 so group members retain write access, producing 0664 files and 0775 directories from those base modes. Limit that setting to the deployment service or session that needs it. Do not change a system-wide umask solely to make one application work, because unrelated files may become readable or writable by a group.
| Umask | Typical file result | Typical directory result | Trade-off |
|---|---|---|---|
0022 |
0644 |
0755 |
Strong default confidentiality; group collaboration needs an explicit adjustment. |
0002 |
0664 |
0775 |
Convenient for a trusted publishing group; review whether group members should read or edit every new file. |
For a systemd service, set the service’s umask in its unit configuration or launch wrapper rather than editing a global shell profile. Restart and verify the effective setting, because a login-shell value does not necessarily apply to a daemon.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Keep the web process out of code-write paths
The web process should normally read application code, templates, and configuration while lacking write permission to them. If an attacker gains code execution through the web process, this separation limits the ability to implant persistent scripts.
Give the service account write access only to specific upload, cache, session, or runtime directories:
chown -R www-data:webdata /var/www/example/shared/uploads
find /var/www/example/shared/uploads -type d -exec chmod 2770 {} +
find /var/www/example/shared/uploads -type f -exec chmod 0660 {} +Use the actual service account and group on your distribution. If uploaded files can be requested directly, prevent them from being interpreted as scripts and store them outside executable application directories. Keep secrets, deployment keys, and configuration containing credentials outside any path that accepts untrusted uploads.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Directories containing scripts or CGI programs should not be writable by the web process. Red Hat’s security guidance specifically recommends that only root have write permission to directories containing scripts or CGIs. Apply that principle to application code unless a documented feature truly requires in-place modification.
Recommended Free Tools
When the application must write in place
Some frameworks require a writable cache, compiled-template directory, or generated asset directory. Isolate that path and document why it is writable. A requirement to update code, plugins, or extensions at runtime deserves a separate design review; granting broad write access to the document root is not an acceptable shortcut.
Use ACLs for narrow exceptions
A shared group is portable and easy to audit when many users need the same access. An ACL is useful when one named account needs an exception without granting that access to every group member.
setfacl -m u:auditor:rx /var/www/example/current
setfacl -m u:releasebot:rwx /var/www/example/shared/uploads
setfacl -d -m g:webdeploy:rwx /var/www/example/shared
getfacl /var/www/example/current /var/www/example/sharedThe first two commands add access entries for named users. A default ACL, such as the third command, supplies inherited entries for new children of a directory; verify how it combines with the process’s umask. ACLs can surprise administrators who inspect only ls -l, so include getfacl output in audits and run a real access test.
| Criterion | POSIX group | ACL |
|---|---|---|
| Users | Best when many users share one policy. | Best for one or a few exceptions. |
| Auditability | Simple membership and mode review. | More precise, but requires checking ACL entries and defaults. |
| Portability | Available on virtually every Linux filesystem. | Filesystem and backup tooling must preserve ACLs. |
| Change management | Change group membership or directory mode. | Change an individual entry without widening group access. |
Configure web-server authorization separately
Filesystem permissions answer whether the server process can read a path. They do not decide which authenticated visitor may retrieve a URL. Protect administration panels, private files, and internal endpoints with the web server’s authentication and authorization features as well.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Use a deny-by-default rule for administrative locations.
- Require authenticated users and authorize the appropriate role or group.
- Do not rely on an unguessable URL as protection.
- Keep private files outside the public document root when they never need direct serving.
- After changing rules, test both an authorized request and an anonymous request, and inspect the server error log.
Apache and Nginx use different directive names and configuration layouts, and distributions place files differently. Check the documentation for the installed major version before copying a configuration snippet. A successful filesystem permission check does not prove that a URL is protected, and a denied URL does not prove that the underlying file is safe from another service.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Verify effective access before production
Test as the real accounts on a staging host or a maintenance window. A permission change is not complete until the expected operation succeeds and an unexpected operation fails.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
- Inspect the path: run
ls -ldon each directory andnamei -l /path/to/fileto inspect every parent component. - Inspect ACLs: run
getfaclon shared and exceptional paths. - Test deployment read and write: use
sudo -u deployorrunuser -u deploy -- commandto create a temporary file, replace a test release, and remove it. - Test web-process access: run a harmless read as the service account, then confirm it cannot create a file in the code directory.
- Test the writable data path: confirm the service can create, update, and delete only the required upload or cache files.
- Test URL authorization: request protected and public URLs with and without credentials.
- Review labels and confinement: on systems using SELinux or AppArmor, check policy status and labels when Unix mode bits look correct but access is still denied.
| Operation | Expected account | Expected result |
|---|---|---|
| Read a public asset | Web process | Allowed. |
| Modify application code | Web process | Denied. |
| Publish a release | Deployment group member | Allowed in the release or staging path. |
| Write an upload | Web process or upload worker | Allowed only in the upload directory. |
| Read an administration URL anonymously | Unauthenticated client | Denied by web-server authorization. |
Why chmod 777 appears to fix errors
chmod 777 grants read, write, and execute to the owner, group, and everyone else. It can hide an incorrect owner, missing group membership, absent directory-traversal bit, ACL entry, or mandatory-access-control label by allowing almost any Unix user to proceed. It also lets any local account or compromised service alter the content.
Replace the workaround with diagnosis:
- Identify the account performing the operation with the service manager, process list, or deployment logs.
- Check owner and group with
ls -l, and check every parent withnamei -l. - Check whether the directory has execute permission for the relevant class.
- Check ACLs with
getfacl. - Check SELinux or AppArmor denials when applicable.
- Grant the smallest required permission to the correct directory, then retest as the real account.
After fixing the cause, remove the broad mode and restore a documented value such as 0644, 0755, or a controlled group mode appropriate to that object.
Common failure modes and repairs
The deploy user still gets “permission denied”
Confirm that the user started a new session after group membership changed. Then verify group ownership on the target directory, group write permission, and execute permission on every parent. An ACL or a service-specific umask may also override the assumption that a group-writable directory will produce group-writable files.
New files have the wrong group
Set the setgid bit on the shared directory and verify that the deployment process is creating files inside that directory rather than in a temporary location. Check whether a tool replaces the directory itself during deployment.
The web process can read but cannot write uploads
Check the actual service account, not the account used for interactive testing. Verify ownership, group membership, directory execute permission, ACLs, and mandatory-access-control labels. Test creation as that account with a temporary file.
Changing permissions broke the site
Restore the previous ownership and mode from your change record, then narrow the change to the specific path that needs it. Review symlinks, release switching, and parent-directory traversal before trying another recursive command.
Operational checklist
- Use named human accounts; do not share administrator credentials.
- Create a dedicated deployment or content group.
- Keep application code and configuration owned by root or a controlled release account.
- Use separate modes for files and directories.
- Use setgid only on directories that intentionally share a group.
- Set a group-friendly umask only for the relevant service or session.
- Give the web process write access only to required data paths.
- Use ACLs for exceptional users and audit them with
getfacl. - Protect sensitive URLs with web-server authentication and authorization.
- Stage and test every change, including denied operations.
- Keep a rollback record for ownership, modes, ACLs, and service configuration.
Final design principle
A secure web root is not defined by one magic numeric mode. It is a tested relationship between identities, ownership, directory traversal, default creation rules, application write requirements, and URL authorization. Share access through a purpose-specific group, isolate mutable data, keep executable code out of web-process write paths, and fix the specific cause of an access error instead of making the entire tree world-writable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
