Understanding File and Folder Permissions

File and folder permissions are security rules that control who can access, view or change the files and folders on your website.

Your website normally uses permissions that are set automatically when files and folders are created. However, you may need to change them when installing an application or troubleshooting a website error.

Incorrect permissions can cause problems:

• Too restrictive: Your website may display a “403 Forbidden” error, images may fail to load, or your application may be unable to save changes.
• Too permissive: Users or processes that should not have access may be able to change your files, potentially putting your website at risk.

You can change permissions using either of the following methods:

• File Manager: Access your website files through the File Manager in the xneelo Control Panel. This is the easier option if you’re unfamiliar with server commands.
• chmod command: If you’re comfortable using SSH, you can use the chmod command (short for change mode) to update permissions.

This article explains how permissions work, what the permission numbers mean and which settings are commonly used.

How do file and folder permissions differ?

Files and folders use the same three permissions: Read, Write and Execute. However, these permissions work differently depending on whether they’re applied to a file or folder.

A folder needs Execute permission to allow access to files inside it, even if those files are only being viewed.

Note: Deleting a file depends mainly on the permissions of the folder containing it, rather than the file’s own Write permission.

Who do permissions apply to?

Each file and folder has an owner and an associated group on the server. Permissions apply to three categories:

• User: The owner of the file or folder.
• Group: Users who belong to the same group as the file or folder.
• Everyone (Other): All other users who don’t fall into the first two categories.

Important: “Other” doesn’t mean everyone visiting your website. It refers to other users or processes on the server. Website visitors don’t automatically gain direct access to your files because Read permission is enabled.

Understanding permission numbers

When using chmod, permissions are often represented by a three-digit number, such as 644 or 755.

Each digit represents a category, always in this order:

User → Group → Other

Each permission has a value:

To determine the permissions for each category, add together the values of the actions you want to allow.

For example:

• 7 (4 + 2 + 1): Read, write and execute.
• 6 (4 + 2): Read and write.
• 5 (4 + 1): Read and execute.
• 4: Read only.
• 0: No permissions.

Example: What does 755 mean?

The permission setting 755 gives different levels of access to the owner, group and other users.

When applied to a folder, this means:

• The owner can view, add, remove and access files inside the folder.
• The group can view the folder’s contents and access files inside it, but cannot make changes to the folder’s contents.
• Other users or processes can also view and access the folder’s contents, but cannot make changes to the folder’s contents.

Access to individual files still depends on the permissions assigned to those files.

Which permissions should I use?

The permissions your website needs depend on your application and hosting configuration. However, the following settings are commonly used:

The permissions your website needs depend on your application and hosting configuration. However, the following settings are commonly used:

For most standard website setups, 644 for files and 755 for folders are commonly used starting points.

Some applications require different permissions to function correctly. Always follow your application’s documentation or consult your web developer before making changes.

Why would you give “Other” (everyone) read, write, or execute?

The 777 permission setting gives User, Group and Other full Read, Write and Execute permissions.

Although this may appear to resolve certain permission errors, it can create security risks by allowing unauthorised server processes or compromised applications to change, delete or upload website files.

We strongly recommend avoiding 777 permissions, particularly on a live website.

If your website or application isn’t working because of a permissions issue, identify which permissions are required rather than setting everything to 777.

Examples of chmod commands

The chmod command has several options that affect its behaviour, with the most common option being -R to change the permissions of a folder and everything inside it, including files and subfolders. Because files and folders often require different permissions, applying the same setting to everything may cause security or functionality issues.

Only change permissions when necessary, and avoid granting more access than your website or application requires.

The following commands demonstrate how permissions can be changed when connected to your server using SSH.

Follow our guide to change permissions using the File Manager in your xneelo Control Panel. 

Leaving files or folders set to 777 permanently on a live, public website is a major security risk. It allows anyone on the internet to inject malicious code, overwrite critical files, or delete data. Once setup or testing is complete, permissions should be restricted back to safer defaults (typically 755 for directories and 644 for files).