FAQ SOP: What file permission numbers should WordPress actually use?

FAQ SOP: What file permission numbers should WordPress actually use?

Stop guessing at 777. Run this exact set.

— Directories: find . -type d -exec chmod 755 {} \;
— Files: find . -type f -exec chmod 644 {} \;
— wp-config.php: chmod 640 wp-config.php (or 600 if PHP runs as the owner).
— Ownership: chown -R youruser:www-data . so the web server can read but not own.
— Verify: find . -perm -o+w must return nothing. Any world-writable file is a backdoor waiting to happen.

755 and 644 are the answer for 99% of installs. 777 means "anyone on the box can rewrite your code." Never use it.

Run this every time you deploy.