Skip to content
Webmaster Tools
Dev utilitiesChmod Calculator750 (rwxr-x---)

chmod 750 (rwxr-x---)

chmod 750 gives the owner full access, lets the group read and enter, and shuts others out. What rwxr-x--- means and how to use it for web roots and home folders.

Command
chmod 750 file
Open in the chmod calculator

What it means

chmod 750 gives the owner read, write and execute permission, gives the group read and execute, and gives everyone else nothing. In ls -l it shows as drwxr-x--- for a directory or -rwxr-x--- for a file.

Who Digit Read Write Execute Symbolic
Owner (u) 7 yes yes yes rwx
Group (g) 5 yes no yes r-x
Others (o) 0 no no no ---

5 is read (4) + execute (1). The symbolic equivalent:

chmod u=rwx,g=rx,o= /var/www/example.com

On a directory

The owner can list, enter and change the directory. Group members can list it and enter it, and open files inside (subject to those files' modes), but can't create, delete or rename anything. Other users can't get in at all.

It's chmod 755 with the "others" bits removed: the right mode when a directory should be shared with exactly one group.

On a file

On a file, 750 means the owner can edit and run it, the group can read and run it, and nobody else can do anything. It suits scripts or binaries meant for one team or one service account, like admin tools in /usr/local/sbin that only an ops group should run.

Typical uses

  • Web roots on shared servers. Own the site as the deploy user, set the group to the web server's group, and others (including other site users on the same machine) can't read your code:
sudo chown -R deploy:www-data /var/www/example.com
sudo find /var/www/example.com -type d -exec chmod 750 {} +
sudo find /var/www/example.com -type f -exec chmod 640 {} +

nginx or Apache (in www-data) can read everything, can't change it, and nobody else gets in.

  • Home directories. Recent Ubuntu releases create new home directories as 750 instead of 755, so other users can no longer browse them. If a web server must reach ~/site, add its user to your group (sudo usermod -aG deploy www-data) and restart it.
  • Config directories like /etc/myapp that a service group must read. Pair 750 on the directory with 640 on the files inside.
  • Data directories for services that support group access, such as PostgreSQL clusters initialized with group access.

Checking group access

For 750 to work, the user that needs access must be in the directory's group, and every parent directory must let that user through.

id www-data                            # groups of the service user
namei -l /var/www/example.com/index.php  # mode and owner of each path step
sudo -u www-data ls /var/www/example.com # test as the service

Added a user to a group? The change applies to new processes only. Restart the service (or log out and back in for a person).

Recursive pitfalls

chmod -R 750 sets execute on every file too, so data files and templates become "executable" to the owner and group. Prefer separate commands for directories and files (as above), or the symbolic X:

chmod -R u=rwX,g=rX,o= /var/www/example.com

X adds execute only to directories and files that were already executable.

Security notes

750 keeps other accounts on the machine out, which matters on shared hosting and on servers where several apps run as different users. It doesn't stop the group from reading secrets, so keep the group small: the web server's group is shared by every site it serves. For files only the owner should read, use chmod 600 inside the 750 directory.

Try the bits yourself in the chmod calculator.