File permissions explained: 755, 644 and why 777 is dangerous

What Are File Permissions and Why Should You Care?

If you've ever encountered a Permission denied error in Linux, know that the root of the problem lies in file permissions. This concept, used in all Unix-based systems including Linux servers, determines who can read, write, or execute a file. In a hosting environment, incorrect file permission settings can lead to hacker intrusions, site crashes, or content not being displayed.

In this article, using simple language and practical examples, we will explain the meaning of each digit in file permissions (such as 755 and 644), examine the difference between files and directories, and most importantly, show why the value 777 is a dangerous security mistake. If you use web hosting services like ServerNet, this knowledge will help you manually manage the security of your files.

File Permission Structure: Three Digits and Three Groups

Each file or directory in Linux has three distinct permission levels, displayed as three octal digits. These digits represent the following permissions in order:

• First digit (Owner): The user who created the file.
• Second digit (Group): The group to which the owner belongs.
• Third digit (Others): All other users on the system.

Each digit is obtained by summing three numbers: 4 (read), 2 (write), and 1 (execute). For example:

• 7 = 4+2+1 (full access: read, write, execute)
• 6 = 4+2 (read and write only)
• 5 = 4+1 (read and execute only)
• 4 = 4 (read only)
• 0 = no access

Example: Permission 755

The value 755 means:

• Owner: 7 (full access)
• Group: 5 (read and execute)
• Others: 5 (read and execute)

This is the most common permission for web directories (e.g., public_html). The owner can create and edit files, while others can only view and execute content (like site visitors).

Example: Permission 644

The value 644 means:

• Owner: 6 (read and write)
• Group: 4 (read only)
• Others: 4 (read only)

This is the standard permission for regular files such as PHP, CSS, or image files. The owner can edit the file, but others can only read it (like a user's browser).

Difference Between File and Directory Permissions

The execute bit (1) has different meanings for files and directories:

• For files: The execute bit means the file can be run as a program. For script files (e.g., PHP), the execute bit is usually not needed unless you want to run them directly from the command line.
• For directories: The execute bit means permission to enter the directory (cd) and access its contents. If a directory only has the read bit (4), you can see the list of files but cannot enter it or read the files inside.

Important note: For web directories, the execute bit (1) must be enabled for group and others. Otherwise, the web server cannot access the directory, and you will receive a 403 Forbidden error.

Why Is Permission 777 Dangerous?

The value 777 means everyone (owner, group, others) has full read, write, and execute access. This means any user on the server (including malicious users) can modify your files, upload malicious scripts, or tamper with site content.

Dangerous scenario: Suppose you have an uploader script on your site set with permission 777. A hacker can exploit this weakness to upload a malicious PHP file (like a webshell) that gives them full control over the server.

Common mistake: Many novice users run the chmod 777 command on an entire directory to quickly fix a Permission denied error. This severely reduces site security. Always try to use the minimum necessary permission level.

When Is 777 Allowed?

777 can only be used in very limited and temporary cases, for example:

• Temporary upload directories where permissions are changed immediately after file upload.
• Cache directories managed by an application whose contents are not sensitive.

In any case, after the task is complete, be sure to revert the permissions to 755 or 644.

How to Change File Permissions

To change permissions, we use the chmod command. Practical examples:

# Change a file's permissions to 644
chmod 644 index.php

# Change a directory's permissions to 755 (recursively for all subdirectories)
chmod -R 755 public_html

# Change permissions only for files inside a directory (without changing directories)
find public_html -type f -exec chmod 644 {} \;

# Change permissions only for directories
find public_html -type d -exec chmod 755 {} \;

Note: Never run chmod -R 777 on the entire web directory. This is an irreversible security mistake.

Checking Current Permissions

You can view file permissions with the ls -l command:

ls -l index.php
# Output: -rw-r--r-- 1 user group 1234 Jan 1 12:00 index.php

In the output above, -rw-r--r-- indicates permission 644. The first dash indicates the file type (regular file), and the remaining characters represent owner access (rw-), group access (r--), and others access (r--), respectively.

Recommended Permissions for Web Files and Directories

On a shared hosting or virtual server, these values are typically recommended:

Note: If you use a content management system like WordPress, some plugins may require permission 755 for specific directories. Always check the plugin documentation.

Troubleshooting Common Permission Issues

500 Internal Server Error

If PHP files have permission 777, some servers may return a 500 error due to security settings (e.g., suPHP). Solution: Change the permission to 644.

403 Forbidden Error

This error usually occurs due to the lack of the execute bit on a directory. Ensure web directories have at least permission 755.

Images Not Displaying

If images are not showing in the browser, check their permissions. They must be at least 644 for the web server to read them.

Conclusion

Proper management of file permissions is one of the fundamental principles of hosting security. By understanding the meaning of each digit and the difference between files and directories, you can prevent security issues and common errors. Always use the minimum necessary permission level and avoid the chmod 777 command except in essential and temporary cases. If you need further guidance in this area, the ServerNet technical support team can assist you.