File Permission Checklist for WordPress VPS: 2026 Guide

Running WordPress on a VPS gives you full control over your server. But with that control comes responsibility. One wrong file permission setting can break your site or open the door to hackers. This file permission checklist for WordPress VPS will walk you through every step. You will learn how to set the right permissions, fix common errors, and keep your site safe. No matter your skill level, this guide is built to be easy to follow.

By the end of this tutorial, you will have a secure WordPress setup. You will also have a file permission checklist for WordPress VPS that you can use again and again.

Quick Reference: WordPress VPS File Permission Cheat Sheet

Before we dive deep, here is a quick look at the key permission values. Save this section for later. It works as a fast reference for your file permission checklist for WordPress VPS.

Permission Values at a Glance

Path	Permission	Notes
All directories	755	Owner reads/writes/enters. Others read/enter.
All files	644	Owner reads/writes. Others read only.
wp-config.php	600 or 640	Only the owner can read this file.
.htaccess	644	Readable by all, writable by owner.
wp-content/uploads	755	Web server must write here.
wp-content/plugins	755	Writable only if needed for updates.
wp-content/themes	755	Same as plugins.
wp-includes	755	Never make this writable.

VPS Server Type Variations (Nginx vs. Apache vs. PHP-FPM)

The file permission checklist for WordPress VPS changes a bit based on your server type. Here is what you need to know:

• Apache with mod_php: PHP runs as the web server user. File owner should match the Apache user.
• Apache with PHP-FPM: PHP runs as its own user. You can set the file owner to your system user.
• Nginx with PHP-FPM: Same as Apache with PHP-FPM. The PHP-FPM pool user needs read access to files and write access to uploads.

In most modern VPS setups, PHP-FPM is the standard. This file permission checklist for WordPress VPS assumes a PHP-FPM setup.

Prerequisites: Identify Your VPS Server Configuration Before Setting File Permissions

Before you change any permissions, you need to know your server setup. This step is a key part of any file permission checklist for WordPress VPS.

How to Find Your Web Server User (www-data, apache, nginx)

Run this command in your terminal:

ps aux | grep -E '[a]pache|[h]ttpd|[n]ginx' | head -5

Look at the first column. That is your web server user. Common values are:

• www-data — Ubuntu/Debian with Apache or Nginx
• apache — CentOS/RHEL with Apache
• nginx — CentOS/RHEL with Nginx

Write down this user name. You will need it for the next steps in this file permission checklist for WordPress VPS.

How to Check Your PHP Execution Mode (mod_php vs. PHP-FPM)

Run this command:

php -r "echo php_sapi_name();"

If it says fpm-fcgi, you are using PHP-FPM. If it says apache2handler, you are using mod_php. This matters because PHP-FPM lets you set file ownership to your system user, which is more secure.

Understanding File Ownership vs. File Permissions on a VPS

Every file on your VPS has two things: an owner and a permission set. The owner is the user who “owns” the file. The permissions tell the system who can read, write, or run the file. Think of it this way: ownership is like having a name on a house deed. Permissions are like the locks on the doors. Both matter for security in your file permission checklist for WordPress VPS.

Step 1: Set Correct Ownership for All WordPress Files on Your VPS

This is the most important step. Wrong ownership causes more problems than wrong permissions.

Why Ownership Matters More Than chmod on a VPS

If the web server user does not own your files, it cannot write to them. This means uploads fail. Plugin updates fail. The WordPress dashboard asks for FTP credentials. Getting ownership right solves all these issues at once.

Set the Correct Owner and Group for WordPress Directories

For PHP-FPM setups, use your system user as the owner and the web server group. Run these commands:

sudo chown -R youruser:www-data /var/www/yoursite

Replace youruser with your SSH login name. Replace www-data with your web server user. Replace /var/www/yoursite with your WordPress path.

Verify Ownership Before Changing File Permissions

Run this command to check:

ls -la /var/www/yoursite

You should see your user name in the third column and the web server group in the fourth column. If this looks right, move to the next step in the file permission checklist for WordPress VPS.

Step 2: Apply Baseline File Permissions for WordPress Core Files

Now we set the base permissions. These work for most files on your WordPress site.

Set Directory Permissions to 755

Run this command:

find /var/www/yoursite -type d -exec chmod 755 {} \;

This finds all folders and sets them to 755. The owner can read, write, and enter. Everyone else can only read and enter.

Set File Permissions to 644

Run this command:

find /var/www/yoursite -type f -exec chmod 644 {} \;

This finds all files and sets them to 644. The owner can read and write. Everyone else can only read.

Verify Baseline Permissions Are Applied Correctly

Run these commands to spot-check:

find /var/www/yoursite -type d ! -perm 755

find /var/www/yoursite -type f ! -perm 644

If no results come back, all files match the baseline. This part of the file permission checklist for WordPress VPS is done.

Step 3: Lock Down Sensitive WordPress Files on Your VPS

Some files hold secrets. Your database password sits in wp-config.php. We need to lock these files tighter than the rest.

Secure wp-config.php (400, 440, 600, or 640)

This file has your database login details. Set it to 600 if your PHP runs as the file owner:

chmod 600 /var/www/yoursite/wp-config.php

If PHP runs as a different user (like www-data), use 640 instead:

chmod 640 /var/www/yoursite/wp-config.php

This is a critical item on any file permission checklist for WordPress VPS.

Protect .htaccess File Permissions

The .htaccess file controls URL rules. Keep it at 644:

chmod 644 /var/www/yoursite/.htaccess

Do not make it writable by everyone. If you use Nginx, this file does not apply to you.

Restrict Access to wp-includes and Other Core Folders

The wp-includes folder holds WordPress core code. No one should write to it outside of updates. Make sure it stays at 755. You can add an extra layer by blocking PHP execution inside it. Add this to your Nginx config or .htaccess:

<FilesMatch "\.php$"> Require all denied </FilesMatch>

Step 4: Configure Writable Directory Permissions for wp-content on a VPS

The wp-content folder needs special care. WordPress must write here for uploads, plugins, and themes.

Set Permissions for wp-content/uploads

The uploads folder must be writable by the web server:

chmod 755 /var/www/yoursite/wp-content/uploads

If the web server user is in the file group, 755 is enough. If not, you may need 775:

chmod 775 /var/www/yoursite/wp-content/uploads

Set Permissions for wp-content/plugins and wp-content/themes

These folders need write access only during updates. Set them to 755 by default:

chmod 755 /var/www/yoursite/wp-content/plugins

chmod 755 /var/www/yoursite/wp-content/themes

If you update through the WordPress dashboard, you may need 775. But 755 with correct ownership works best.

Handle wp-content/cache and Other Runtime Directories

Cache plugins need to write to their cache folders. Set these to 755:

chmod 755 /var/www/yoursite/wp-content/cache

If a caching plugin creates its own folder, make sure it inherits the right permissions.

When to Use 775/664 vs. 755/644 on a VPS

Use 775 for directories and 664 for files only when the web server user is different from the file owner. With correct ownership and PHP-FPM, 755/644 is almost always enough. This is a common question in any file permission checklist for WordPress VPS.

Step 5: Harden WordPress File Permissions Against Common VPS Threats

Now we go beyond the basics. These steps protect your site from real-world attacks.

Never Use 777 — Why and How to Fix It

Setting any file or folder to 777 means everyone on the server can read, write, and run it. This is a huge security risk. If a hacker finds a way in, 777 gives them full access. To find and fix any 777 files:

find /var/www/yoursite -perm 777

find /var/www/yoursite -perm 777 -exec chmod 755 {} \;

Never use 777. This is the number one rule in this file permission checklist for WordPress VPS.

Remove Execute Permissions from Uploaded Files

Uploaded images and documents should never have execute permissions. Hackers sometimes upload PHP files disguised as images. Remove execute bits from the uploads folder:

find /var/www/yoursite/wp-content/uploads -type f -exec chmod 644 {} \;

Set Up Immutable Flags on Critical Config Files

You can make a file unchangeable, even by root. Use the immutable flag:

sudo chattr +i /var/www/yoursite/wp-config.php

To remove the flag later:

sudo chattr -i /var/www/yoursite/wp-config.php

This stops even hackers with root access from changing the file. Use this on wp-config.php after you finish all other setup steps.

Step 6: Automate WordPress File Permission Checks With Bash Scripts

Manual checks get old fast. Let us automate this file permission checklist for WordPress VPS.

One-Command Script to Reset All WordPress Permissions

Create a file called fix-permissions.sh:

#!/bin/bash

WP_PATH="/var/www/yoursite"

WP_USER="youruser"

WP_GROUP="www-data"

sudo chown -R $WP_USER:$WP_GROUP $WP_PATH

find $WP_PATH -type d -exec chmod 755 {} \;

find $WP_PATH -type f -exec chmod 644 {} \;

chmod 600 $WP_PATH/wp-config.php

echo "Permissions reset complete."

Make it executable:

chmod +x fix-permissions.sh

Run it anytime with:

sudo ./fix-permissions.sh

Set Up a Cron Job for Periodic Permission Audits

Run the script once a week with cron:

sudo crontab -e

Add this line:

0 3 * * 0 /path/to/fix-permissions.sh >> /var/log/wp-permissions.log 2>&1

This runs every Sunday at 3 AM. It keeps your file permission checklist for WordPress VPS up to date.

Log Permission Changes for Security Monitoring on Your VPS

Use the auditd tool to watch for permission changes:

sudo auditctl -w /var/www/yoursite/wp-config.php -p wa -k wp-config-watch

Check the log with:

sudo ausearch -k wp-config-watch

This tells you if anyone changes your config file.

Troubleshooting: Common WordPress File Permission Errors on a VPS

Sometimes things go wrong. Here are the most common problems and how to fix them.

“403 Forbidden” Errors After Changing File Permissions

This error means the web server cannot read a file or enter a folder. Check that:

• All parent folders have at least 755 permissions.
• The web server user has read access to all files.
• SELinux or AppArmor is not blocking access. Run sudo setenforce 0 to test (remember to turn it back on).

“Unable to Write to wp-content” Upload Errors

This means the web server cannot write to the uploads folder. Fix it by:

• Setting the correct group: sudo chgrp -R www-data /var/www/yoursite/wp-content/uploads
• Setting group write: chmod -R 775 /var/www/yoursite/wp-content/uploads

WordPress Asks for FTP Credentials After Permission Change

WordPress asks for FTP when it cannot write files directly. This usually means wrong ownership. Fix it with:

sudo chown -R youruser:www-data /var/www/yoursite

You can also add this to wp-config.php as a quick fix:

define('FS_METHOD', 'direct');

Plugin or Theme Update Fails Due to Permission Denied

Make sure the plugins and themes folders are writable by the web server:

chmod 775 /var/www/yoursite/wp-content/plugins

chmod 775 /var/www/yoursite/wp-content/themes

After the update, set them back to 755 for better security.

FAQ: File Permission Checklist for WordPress VPS

What Are the Correct File Permissions for WordPress on a VPS?

Directories should be 755. Files should be 644. The wp-config.php file should be 600 or 640. These values work for most VPS setups and form the core of this file permission checklist for WordPress VPS.

How Often Should I Check WordPress File Permissions on My VPS?

Check them after every update. Set up a weekly cron job to audit permissions. If you notice anything strange, check right away. A good file permission checklist for WordPress VPS includes regular reviews.

Does Changing File Permissions Affect Website Performance?

No. File permissions do not affect speed. They only control who can access files. Your site will run the same whether permissions are 644 or 664.

Should I Use Different File Permissions for Nginx vs. Apache on a VPS?

The permission values stay the same. The difference is in how you set ownership. With Nginx and PHP-FPM, set the file owner to your system user. With Apache and mod_php, set the owner to the Apache user. The file permission checklist for WordPress VPS stays mostly the same.

What Happens If I Set WordPress Files to 777?

Setting files to 777 lets any user on the server read, write, and execute them. A hacker who gains access to any account on your VPS can modify your WordPress files. They can add malware, steal data, or take over your site. Never use 777. This is the most important rule in this file permission checklist for WordPress VPS.

Conclusion and Final Recommendations

You now have a complete file permission checklist for WordPress VPS. Let us review the key points:

• Set correct ownership before changing permissions.
• Use 755 for directories and 644 for files.
• Lock down wp-config.php to 600 or 640.
• Never use 777 for any file or folder.
• Automate checks with scripts and cron jobs.
• Fix problems fast using the troubleshooting section.

Keep this file permission checklist for WordPress VPS bookmarked. Run the audit script every week. Your site will stay secure and run without permission errors. If you follow this guide, your WordPress VPS will be safer than 90% of sites on the internet.

Next steps: set up the automation script today. Then schedule a monthly review of your server logs. Security is not a one-time task. It is a habit. Start building that habit now with this file permission checklist for WordPress VPS.