chmod 755 vs 644: Which Permissions to Use and Why

Each of the three digits describes permissions for one audience, in a fixed order: the file's owner, the group, then everyone else. Each digit is the sum of three values — read is 4, write is 2 and execute is 1 — so every combination produces a unique total between 0 and 7.

755 breaks down as 7 for the owner (4+2+1, so read, write and execute), and 5 for both group and other (4+1, read and execute but not write). 644 is 6 for the owner (4+2, read and write) and 4 for the other two (read only). Neither grants write access to anyone but the owner, which is the property that matters most on a server.

This is the part that trips people up, because the execute bit means something completely different depending on what it is set on. On a regular file, execute means the kernel may run it as a program — which a stylesheet, an image or an HTML page has no need for, hence 644.

On a directory, execute means permission to traverse into it and reach the entries inside by name. Without it, nobody can open a file in that directory even when the file itself is world-readable. That is why directories get 755 while the files inside them get 644.

There is a related subtlety: the read bit on a directory grants permission to list the names of what is inside, but not to access any of it. A directory with read but no execute produces confusing errors where you can see that a file exists but every attempt to open it is denied.

Plenty of support articles suggest chmod 777 when an upload or cache directory will not work. It does usually make the error go away, because it grants read, write and execute to every account on the system — including any account an attacker manages to compromise. On shared hosting that can mean other customers on the same machine.

The underlying problem is almost always ownership rather than permissions. The web server runs as its own user, and if that user does not own the directory, no permission short of world-writable will help. The correct fix is chown to give the directory to the right user or group, then set 755 or 775. If you use 777 to confirm a diagnosis, change it back immediately afterwards.