The root folder is required to be readable by world.
https://www.getastra.com/blog/cms/wordpress-security/wordpress-file-permissions
Wp-config.php.
is most sensitive
Should be 400/444.
User & server no right to edit.
Others cannot even read.
Index.php
644/444 (higher security)
Only admin can write/execute.
.php
644.
Users can read & write.
Groups & others can only read.
folders
755.
Read, write, execute for user.
Reads and execute for group.
None for all others.
Updated:
2026 Aug 19
