The safe starting point for a WordPress site on an Ubuntu VPS is 0755 for directories and 0644 for files, with ownership assigned deliberately and write access limited to the directories that need it. Protect wp-config.php with a stricter mode such as 0400 or 0440. Do not repair a failed upload or update by making the whole site 0777: that gives every local account and compromised process permission to alter your code.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
The exact owner and writable paths depend on how PHP runs on your server. A simple installation may use www-data, while a multi-site VPS should normally use a separate site user and an isolated PHP-FPM pool. The procedure below identifies your real process user, resets only the normal baseline, grants narrowly scoped write access, and verifies the failing WordPress action.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
What the standard permissions mean
Linux permissions have three classes: the file owner, the owning group, and everyone else. Each class can receive read (4), write (2), and execute (1) rights. For a directory, execute means the account may traverse it and access entries whose names it knows; read allows listing its contents. That distinction is why a web process can need directory execute permission even when it should not be able to modify files.
| Path or object | Typical mode | Purpose | Security note |
|---|---|---|---|
| WordPress directories | 0755 |
Owner can read, write and traverse; group and others can read and traverse. | Suitable baseline for core, plugins and themes when they are not being edited by the web process. |
| WordPress files | 0644 |
Owner can read and write; group and others can read. | Prevents ordinary visitors from writing PHP or configuration files. |
wp-config.php |
0400 or 0440 |
Only the owner, or the owner and an intentional group, can read it. | Use the stricter value only after confirming the PHP account can still read the file. |
| Any broad WordPress tree | 0777 |
Everyone can read, write and traverse. | Unsafe as a blanket repair; it permits unrelated users or compromised services to modify the site. |
These values are a baseline, not a promise that every extension will work without adjustment. WordPress recommends locking permissions down and loosening them only for a function that genuinely needs write access.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Ownership determines who can write
Mode bits cannot compensate for the wrong owner or group. Your deployment account may own the files while Apache or PHP-FPM runs as another account. The web process needs read and traverse access to serve the site, and it needs write access only where WordPress must create or change data.
The simple single-site model
On a basic Ubuntu installation, Apache and many PHP-FPM pools run as www-data. Making the site tree owned by www-data can make updates easy because the web process can write files, but it also gives that process broad control over your code. It is a poor default for a VPS hosting unrelated sites or maintainers.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsThe isolated site-user model
A stronger arrangement gives each site a separate Unix user, keeps the deployment files owned by that user, and runs that site’s PHP-FPM pool as the same user. The pool can then write the upload directory without gaining access to another site’s files. This requires more setup, but it narrows the damage from a compromised plugin or application.
Check the real accounts before changing anything
Do not assume that www-data is the effective account. Inspect the virtual-host document root and the PHP-FPM pool configuration, then confirm the running processes. Typical checks include:
ps -eo user,group,comm,args | grep -E 'apache2|php-fpm' | grep -v grep
sudo grep -R "^user|^group" /etc/php/*/fpm/pool.d/ 2>/dev/null
sudo namei -l /path/to/wordpressThe first command shows users attached to web processes; the second shows configured PHP-FPM pool identities; and namei reveals whether a parent directory blocks traversal. Replace the path with your actual document root.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Back up and record the current state
Permission repairs are reversible only if you know what changed. Before running recursive commands, create a database and file backup using your normal backup system. Also record the current ownership and modes so you can undo an accidental change:
cd /path/to/wordpress
sudo stat -c '%A %a %U:%G %n' wp-config.php wp-content wp-content/uploads
sudo find wp-content -maxdepth 2 -printf '%M %u:%g %pn' | head -n 100Make sure the backup is stored outside the web root and that you can restore it. A permissions change should never be your only copy of a production site.
Reset the normal WordPress baseline
Run the baseline from the WordPress root, not from an arbitrary parent directory. The following commands set every directory to 0755 and every regular file to 0644:
sudo find /path/to/wordpress -type d -exec chmod 755 {} ;
sudo find /path/to/wordpress -type f -exec chmod 644 {} ;This deliberately resets plugin, theme and upload contents too. If a particular application supplied a documented executable file or special mode, note it first and restore that exception afterward. Do not add a recursive chmod 777 command to “make sure” the reset works.
After the reset, verify representative paths:
stat -c '%A %a %U:%G %n' /path/to/wordpress /path/to/wordpress/wp-admin /path/to/wordpress/index.phpChoose and apply ownership deliberately
Ownership commands differ by deployment. The important questions are who owns the files, which account executes PHP, which directories must be writable, and whether sites share users or groups.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
| Deployment | File owner | PHP account | Write strategy | Trade-off |
|---|---|---|---|---|
| Simple single site | Often www-data or one site user |
Usually www-data |
Grant writes to wp-content/uploads and documented plugin paths. |
Easy operation, but a compromised web process may control more of the tree. |
| Site user with shared group | Dedicated site user and group | PHP runs in that group or as the site user | Use group-readable modes and group write only where required. | Balances deployment access and web writes; group membership must be maintained carefully. |
| Per-site PHP-FPM pool | Dedicated site user | The same dedicated site user | Keep core read-only and make only required content directories writable. | More configuration, but stronger isolation between sites. |
If you have one isolated site and have intentionally chosen the web account as its owner, a command such as the following may be appropriate:
sudo chown -R www-data:www-data /path/to/wordpressDo not run that command blindly on a server with multiple sites. Ubuntu cautions that making a whole multi-site tree www-data-owned can let the web account alter files maintained by other users. In a per-site-user design, use the dedicated account instead:
sudo chown -R siteuser:siteuser /path/to/wordpressThen configure the PHP-FPM pool and deployment process so the effective PHP account can traverse the tree and write only the intended directories. If PHP runs as a different group, grant that group access explicitly rather than changing every file to be owned by the web server.
Grant write access only where WordPress needs it
wp-content is the normal exception to a read-mostly WordPress tree. Media uploads are stored below wp-content/uploads; some plugin and theme operations may also need a documented subdirectory. Start with the narrowest path:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo chown -R siteuser:webgroup /path/to/wordpress/wp-content/uploads
sudo find /path/to/wordpress/wp-content/uploads -type d -exec chmod 775 {} ;
sudo find /path/to/wordpress/wp-content/uploads -type f -exec chmod 664 {} ;Use the owner and group that match your actual PHP-FPM configuration. The 775/664 example gives the owner and group write access while leaving other users read-only; if the web process is the owner, 755/644 may be enough. Avoid making all of wp-content writable when only uploads fail.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
A plugin may require a cache, export, backup or temporary subdirectory. Read that plugin’s documented requirement and change only that path. If an installer needs to replace plugin files, consider performing the update as the deployment user over SSH or temporarily granting a controlled write permission, then return the directory to its normal restrictive mode.
Protect wp-config.php without breaking PHP
wp-config.php contains database credentials and other secrets. In a per-site-user setup where PHP runs as the owner, use:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutesudo chmod 400 /path/to/wordpress/wp-config.phpIf PHP intentionally reads through an owning group, use an equivalent owner/group-readable mode such as 0440 and ensure unrelated users are not in that group. Verify the web page and a database-backed request after changing the mode. A “permission denied” error at this point means the process account or group model is inconsistent; do not solve it by making the file world-readable.
Retest the exact failing operation
Test one action at a time so you know which permission change mattered:
- Log in to WordPress and upload one small image to the Media Library.
- If uploads succeed, test the specific plugin or theme installation that previously failed.
- Run one update only, then check that the updated files retain the expected owner and mode.
- Remove the test upload if it is not needed and review the web server or PHP-FPM error log for the exact path if the action still fails.
You can test access as the effective PHP account without changing permissions globally:
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
sudo -u www-data test -r /path/to/wordpress/wp-config.php && echo readable
sudo -u www-data test -w /path/to/wordpress/wp-content/uploads && echo writable
sudo -u www-data test -x /path/to/wordpress/wp-content/uploads && echo traversableReplace www-data with the account shown by your PHP-FPM pool. If a test fails, inspect every parent directory with namei -l; one parent lacking execute permission can produce the same symptom as an incorrectly owned file.
Diagnose common permission-denied symptoms
Media uploads fail
Confirm that the configured uploads directory exists, is writable and is traversable by PHP. Check the path shown under WordPress settings and the error log rather than granting write access to the entire WordPress root. Correct ownership or group membership on wp-content/uploads, then retry one upload.
Plugin or theme installation fails
Core directories may correctly be read-only. If WordPress cannot install through the dashboard, identify whether the installer needs a temporary directory, a specific plugin directory or FTP credentials. Grant the documented subdirectory to the effective PHP account, or deploy the package as the site user over SSH. Do not recursively loosen every plugin and theme file.
Updates create files owned by the wrong account
This usually means the update ran as PHP rather than the deployment user. Decide whether dashboard updates are part of your operating model. If they are, align the PHP-FPM pool and group permissions for that site; if they are not, update from the command line as the site user and keep the web process read-only.
The site returns a 403 or PHP cannot read configuration
Check parent-directory traversal, the document-root path, the PHP-FPM pool user and the mode on wp-config.php. Restore the intended owner/group-readable mode, test a database-backed page, and then tighten the file again once the account model is corrected.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Multi-site VPS safeguards
- Give each site a distinct Unix user and, where practical, a distinct PHP-FPM pool.
- Keep each document root outside another site’s writable directories.
- Do not make a shared
www-dataaccount the owner of every site unless you accept the resulting cross-site control. - Limit group membership so one site’s deployment user cannot write another site’s files.
- Review ownership after migrations, restores and automated deployments; archive extraction often resets owners or modes.
Isolation does not replace patching, backups or application security. It limits how far a compromised plugin or web process can move when a permission mistake or vulnerability is exploited.
A repeatable repair checklist
- Identify the virtual-host root and the account running PHP for that site.
- Back up the database and files, then record current ownership and modes.
- Reset directories to
0755and files to0644from the correct WordPress root. - Assign ownership to the deliberate site user and group; avoid a blanket
www-dataownership change on multi-site servers. - Grant write access only to
wp-content/uploadsor another documented subdirectory. - Set
wp-config.phpto0400or an intentional equivalent such as0440. - Test one upload or update as the effective PHP account and inspect the exact failing path if it still fails.
This process fixes the cause instead of masking it. Least privilege keeps WordPress usable while reducing the number of files a compromised web process can alter.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
