File Permission Audit SOP

File Permission Audit SOP
Choosing the permission scheme for a web app. Tighter isn't always workable.

— Set directories to 755, files to 644 as the safe default: owner writes, web server reads.
— Drop config files (wp-config.php, .env) to 640 or 600: secrets shouldn't be world-readable on shared hosting.
— Use 644 (not 640) for assets the web server must read when PHP-FPM runs as a different group than the file owner.
— Never use 777 anywhere: if uploads need writes, set the directory to 755 owned by the web user, not world-writable.
— Verify: run find . -perm -o+w to list every world-writable file. The list should be empty.

Run this after every deploy and plugin install.