File Permissions Explained: The One-Minute Guide That Prevents Hacks
File Permissions Explained Without the Jargon
File permissions are one of those topics that sound intimidating, so they often get ignored. Many site owners assume “the server handles that.”
Unfortunately, incorrect permissions are one of the most common reasons websites get hacked, particularly on shared hosting.
The good news is that you don’t need to become a system administrator to understand the basics. A simple understanding of how permissions work can eliminate a large portion of real-world attack paths.
What File Permissions Actually Control
Every file and folder on your website has rules attached to it. Those rules determine who can read the file, who can modify it, and whether it can be executed as a script.
There are three types of actions:
Read allows someone to view the contents.
Write allows someone to change or replace the file.
Execute allows a file to run as a program or script.
These actions apply to three different groups: the owner (usually your hosting account), the group (often other users on the same server), and everyone else (effectively the public).
When permissions are too loose, attackers don’t need to break through security. They simply take advantage of access that has already been granted.
Why Permissions Look Like Numbers
Permissions are typically written as three-digit numbers such as 755 or 644. Each digit represents the combined permissions for one of the three groups: owner, group, and public.
Behind the scenes, each action has a numeric value. Read equals 4, write equals 2, and execute equals 1. These values are added together.
A 7 means read, write, and execute all at once (4 + 2 + 1).
A 5 means read and execute, but not write (4 + 1).
A 4 means read-only.
So when you see 755, it means the owner has full control, while group and public can read and execute but not modify.
Once you understand that pattern, the numbers stop looking mysterious.
Safe Defaults for Most Websites
For most content management systems and standard websites, there are predictable safe settings.
Folders are typically set to 755. This allows the server to enter and read them, but only the owner can modify their contents.
Files are typically set to 644. They can be read by the server and by visitors when needed, but only the owner can change them.
Sensitive configuration files, such as those containing database credentials or environment variables, should be even more restrictive — often 600 or 640 — so that only the owner can read them at all.
One number you should almost never see is 777. That setting allows anyone on the server to read, write, and execute the file or folder. It effectively removes meaningful protection.
If 777 appears, it is usually a workaround for a misconfiguration rather than a proper solution.
How Permission Mistakes Turn Into Hacks
Most website breaches are not targeted attacks. They are automated scans searching thousands of sites for easy opportunities.
If a folder is writable by everyone, an attacker can upload a malicious script. If a plugin or theme file is writable, injected code can be added and remain persistent.
On shared hosting, overly permissive settings can sometimes allow cross-account interference if isolation is weak.
Permissions alone do not make a site invincible. But they close off the simplest entry points. Attackers tend to move on quickly when those doors are shut.
A Quick Check You Can Do Today
If you have FTP, SFTP, or hosting panel access, you can inspect permissions directly.
Look for any instances of 777. That is the clearest red flag. Upload directories need to be writable in controlled ways, but core application files rarely require write access once deployed.
If you are unsure, reducing write access is generally safer than expanding it.
The One Rule That Matters
If you remember only one principle, make it this: write access should be rare. Read access is usually enough.
Many websites quietly violate this rule without realising it. That is why file permission mistakes remain one of the easiest and most common paths to compromise.
A small adjustment in permissions can remove an entire category of preventable risk.