Updated: 28 September 2026 · Applies to: cPanel & WHM 138 (Jupiter theme) and Apache 2.4 (.htaccess)
On cPanel servers, PHP usually runs as your own cPanel user (PHP-FPM, suPHP or LSAPI). PHP files then only need to be readable and writable by you, so use these permissions:
- PHP and other files: 644 (you can read and write; everyone else can only read)
- Folders: 755
- Configuration files that hold passwords (for example
wp-config.php): 600 or 640, if the application still works with it
Never use 777. A world-writable file can be changed by any process on the server, which is a common way sites get infected. Some PHP handlers, such as suPHP, refuse to run such files and show a 500 Internal Server Error instead.
Change permissions in cPanel
In cPanel › File Manager, select the file or folder, click Permissions, set the value and save.
Reset a whole site over SSH
cd ~/public_html
find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;
Run it from the site's own folder, and set tighter permissions on configuration files again afterwards.
