What it means
chmod 644 gives the owner read and write access, and everyone else (the group and all other users) read-only access. It's the most common mode for ordinary files. In ls -l it shows as -rw-r--r--.
| Who | Digit | Read | Write | Execute | Symbolic |
|---|---|---|---|---|---|
| Owner (u) | 6 | yes | yes | no | rw- |
| Group (g) | 4 | yes | no | no | r-- |
| Others (o) | 4 | yes | no | no | r-- |
The symbolic equivalent:
chmod u=rw,go=r index.html
Why files are usually 644
Programs normally create files with mode 666 and let the umask take bits away. The usual umask is 022, which removes write for group and others: 666 minus 022 gives 644. So most files you create with an editor, touch or a shell redirect already come out as 644. Run umask to see yours.
On a file
The owner can edit the file. Every other user and every service on the machine can read it. Nobody can execute it as a program, because no execute bit is set.
On a directory
644 is wrong for a directory. Without execute (x), nobody can cd into it or open the files inside, even though they can list the names. Directories that should be readable by everyone use chmod 755. If a site suddenly returns 403 Forbidden for everything under a folder, a directory set to 644 is a likely cause.
Web roots: 644 files, 755 directories
The classic, safe layout for a website is files at 644 and directories at 755, owned by the deploy user rather than by the web server.
find /var/www/example.com -type d -exec chmod 755 {} +
find /var/www/example.com -type f -exec chmod 644 {} +
nginx or Apache only need to read files, and 644 lets them. Because the files belong to another user, a compromised PHP script running as www-data can't rewrite your code. Directories that the app must write to (uploads, cache) are the exception; give those to the web server's group with chmod 775 or narrower.
Don't use chmod -R 644
chmod -R 644 /var/www/example.com # breaks the site
This also sets every directory to 644, removing execute, and the server can no longer reach any file. Visitors get 403 Forbidden. Use the two find commands above instead, or the symbolic X, which adds execute only to directories (and files that are already executable):
chmod -R u=rwX,go=rX /var/www/example.com
When 644 is wrong for a file
- Secrets.
.env,wp-config.phpwith database passwords, private keys. 644 lets every local user and service read them. Use chmod 600, or chmod 640 with the web server's group. - Scripts and binaries. A shell script at 644 can't be run as
./script.sh("Permission denied"). Use chmod 755, or run it asbash script.sh. - SSH private keys. SSH rejects a 644 private key. Public keys (
id_ed25519.pub) are fine at 644.
Security notes
Readable by others means readable by every account on the machine, including any compromised service. On a single-purpose server that's usually acceptable for code and static assets. On shared hosting, it means other customers may be able to read your files, so keep anything sensitive at 640 or 600.
Related modes
- chmod 755: the matching mode for directories and executables.
- chmod 664: the group can also write.
- chmod 600: for files only the owner should see.
Open the chmod calculator to compare it with other modes.