For web files hosted on Linux servers, standard files should use 644 permissions and directories should use 755 permissions. These settings provide the right balance between functionality and security, allowing your web server to read files while preventing unauthorized modifications. OBHost servers automatically apply these permissions when you upload files through cPanel File Manager or standard FTP clients.
Standard File Permissions (644)
Most web files, including HTML, CSS, JavaScript, images, and regular PHP scripts, should use chmod 644. This permission setting means:
- Owner (you) can read and write the file
- Group members can read the file
- Everyone else can read the file
When you upload files through cPanel File Manager, this permission is applied automatically. Most FTP clients also default to 644 for newly uploaded files unless configured otherwise.
Special File Permission Cases
Configuration Files with Sensitive Data (600)
PHP files containing sensitive information like database credentials should use chmod 600. This applies to files such as:
- WordPress wp-config.php
- Joomla configuration.php
- Drupal settings.php
- Any custom configuration files with passwords or API keys
With chmod 600, only you (the file owner) can read and write these files. Setting all PHP files to 600 won't cause problems because PHP scripts are interpreted by the PHP engine, not executed directly, so they don't need execute permissions.
Shell and Cron Scripts (700)
Scripts executed directly from the command line or via cron jobs require chmod 700. This includes:
- PHP scripts with shebang lines run from SSH
- Perl scripts executed as command-line programs
- Python scripts run through crontab
- Bash shell scripts
These files need execute permissions because your Linux user account runs them directly, not through the web server.
CGI Scripts (700)
Scripts in your cgi-bin directory or configured to run as CGI programs should use chmod 700. Like shell scripts, these are executed directly by your user account and require execute permissions.
.htaccess Files (444 or 644)
While .htaccess files work fine with chmod 644, setting them to chmod 444 (read-only) provides better security. This makes the files harder to modify through file injection attacks or compromised scripts.
Directory Permissions (755)
All web directories should use chmod 755. This allows:
- Owner (you) to read, write, and access the directory
- Group members to read and access the directory
- Everyone else to read and access the directory
The web server needs to access directories to serve files inside them. Like files, cPanel File Manager and standard FTP clients automatically set new directories to 755.
Why Not Follow Software Installation Guides?
Many PHP application installation guides recommend overly permissive settings like chmod 777 for directories or chmod 755 for PHP files. You can safely ignore these recommendations on OBHost servers.
These excessive permissions are unnecessary because OBHost runs PHP through suPHP/suEXEC or similar technology. This means PHP scripts execute under your cPanel username's security context, not as a separate web server user. Since your username owns your files, PHP can read and write them with just 644 or 600 permissions.
Software developers often prioritize making their applications work across any server configuration rather than optimizing security for specific setups. Using more restrictive permissions protects your website without breaking functionality.
How to Check and Change Permissions
You can view and modify file permissions through several methods:
- cPanel File Manager: Right-click any file or folder and select "Change Permissions"
- FTP Client: Most FTP programs let you right-click files to change permissions
- SSH Command Line: Use the chmod command (e.g., chmod 644 filename.php)
When changing permissions recursively on multiple files, be careful to distinguish between files and directories so each gets the appropriate setting.
Frequently Asked Questions
What happens if I use chmod 777 on my files or directories?
Chmod 777 makes files and directories writable by everyone on the server, creating a serious security vulnerability. Malicious scripts or compromised accounts could modify or delete your files. Always use the minimum permissions necessary for your files to function.
Why do my PHP files work with chmod 600 when other hosts require 644?
OBHost servers run PHP under your account's ownership through suPHP or similar technology. On servers where PHP runs as a different user (like the Apache user), files need 644 permissions so that user can read them. Our security model is more restrictive and safer.
Can I use chmod 400 for extra security on config files?
While chmod 400 (read-only for owner) works for purely configuration files, it prevents you from editing them through File Manager or FTP. Use 600 if you need to modify files occasionally, or 400 if they truly never change and you'll edit them only through SSH when needed.
What permissions should I use for upload directories?
Directories where users upload files (like WordPress media uploads) should remain at 755. The directory itself doesn't need write permissions; PHP running as your user can create files inside it. Uploaded files will automatically get 644 permissions, which is correct.
For assistance with file permissions or other hosting questions, the OBHost support team is available 24/7 through our contact page or by emailing support@obhost.org.
