Why chmod 777 is dangerous

When a plugin misbehaves, forums often say “just give the folder 777”. That usually hides the problem for a while and leaves your site exposed.

What the three digits mean

Each digit is for the owner, the group and others, in that order. Read is 4, write 2 and execute 1, added together. 644 means the owner can read and write and everyone else can only read. 755 also lets everyone execute, which for folders means entering them.

The problem with 777

777 means any process on the server can change the file. A vulnerable plugin or another process can use that to inject malicious code. Many servers also refuse to run PHP files with 777 for security and return a 500 error.

Recommended values

• Folders: 755
• Files (HTML, PHP, images): 644
• Secret config files such as wp-config.php or .env: 600 or 640

On shared hosting, files run as your account, so even folders that need writing work with 755.

403 errors and permissions

Without the execute (x) bit on a folder the web server cannot enter it and visitors get a 403 error. find commands that set folders to 755 and files to 644 fix wrong permissions in bulk.

The chmod calculator lets you read and build permissions and see risky settings.