Knowledgebase

File & Directory Permissions (Firstserv Guide)

Setting the correct file and directory permissions is important for both security and functionality on your hosting account. This guide outlines the recommended permissions for common file types.

File Permissions

Standard File Permissions

• ✅ Most files should be set to:

  644
  

This allows:

• The owner to read/write
• Others to read only

Sensitive Files (Recommended: 600)

For files containing sensitive information (e.g. database credentials):

• Example: wp-config.php (WordPress)

Set permissions to:

600

✅ This restricts access to the file owner only, improving security.

Executable Scripts (700)

Scripts that are run directly by the server (not via a web request) should be set to:

700

This includes:

• Scripts run via cron jobs
• Command-line scripts with a shebang (e.g. PHP, Python, Perl)
• CGI scripts in directories like /cgi-bin

✅ These require execute permissions to run properly.

.htaccess Files

• Standard:

  644
  

• More secure (recommended):

  444
  

✅ Setting to 444 makes the file read-only, helping protect against certain types of attacks.

Directory Permissions

All directories should be set to:

755

This allows:

• The owner to read/write/execute
• Others to read/execute (needed to access files inside)

Default Behaviour

When using cPanel tools:

• File Manager

  • Files default to 644
  • Directories default to 755

• FTP uploads

  • Usually follow the same defaults unless explicitly configured otherwise

What If an Application Recommends Different Permissions?

Some applications or installation guides may suggest:

• ❌ 777 (full access for everyone)
• ❌ 755 for PHP files

⚠️ These recommendations are often made for compatibility, not security.

Firstserv Environment Behaviour

On Firstserv hosting:

• PHP runs under your account user (suEXEC)
• This means:
  • PHP files only need owner-level permissions
  • They do not require execute permissions

✅ As a result, you can safely use:

• 600 or 644 for PHP files

Best Practices

• ✅ Use the least permissive settings needed
• ✅ Avoid 777 unless absolutely necessary (and even then, temporarily)
• ✅ Secure sensitive configuration files
• ✅ Regularly review permissions on your site

Summary

Correct permissions help protect your website from unauthorised access while ensuring everything runs smoothly.

If you’re unsure about your file permissions or need help adjusting them, the Firstserv support team is always available to assist.