What it means
chmod 755 gives the owner read, write and execute permission, and gives the group and everyone else read and execute. It's the default mode for directories and the usual mode for programs and scripts. In ls -l it shows as drwxr-xr-x for a directory or -rwxr-xr-x for a file.
| Who | Digit | Read | Write | Execute | Symbolic |
|---|---|---|---|---|---|
| Owner (u) | 7 | yes | yes | yes | rwx |
| Group (g) | 5 | yes | no | yes | r-x |
| Others (o) | 5 | yes | no | yes | r-x |
The symbolic equivalent:
chmod u=rwx,go=rx deploy.sh
A common shortcut for scripts is chmod +x deploy.sh, which adds execute for everyone allowed by your umask. On a 644 file with umask 022, that gives 755.
On a directory
Everyone can list the directory and enter it, and open files inside (subject to the files' own modes). Only the owner can add, delete or rename files. That's why new directories normally come out as 755: mkdir asks for 777, and the common umask 022 removes write for group and others.
On a file
The owner can edit and run the file. Everyone else can read and run it, but not change it. That's the right mode for:
- Shell, Python or Perl scripts you want to run as
./script.sh. - Binaries in
/usr/local/binand similar places. - CGI scripts that the web server executes.
Scripts need read as well as execute, because the interpreter reads the file. That's why 755 (and not 711) is the usual mode for shared scripts.
Web roots: 755 directories, 644 files
The standard, safe layout for a website is directories at 755 and files at 644, owned by your deploy user:
find /var/www/example.com -type d -exec chmod 755 {} +
find /var/www/example.com -type f -exec chmod 644 {} +
The web server can enter every directory and read every file, but can't modify your code. Only directories the app must write to (uploads, cache, sessions) need more, and they should get it through the server's group rather than through 777.
The chmod -R 755 trap
chmod -R 755 /var/www/example.com
This fixes "403 Forbidden" quickly, but it also makes every file executable: HTML, images, .env, uploaded files. Executable data files aren't a direct hole on most setups, but they make real executables harder to spot, and some server configurations treat executable files differently. Use the find commands above, or the symbolic X:
chmod -R u=rwX,go=rX /var/www/example.com
X gives execute only to directories and to files that already had it.
When 755 is too open
- Home directories on a multi-user machine: other users can browse your files. Many distributions now use chmod 750 or chmod 700.
- Config directories with secrets. Anyone can list and enter; protect the files inside with 640 or 600, or use 750 on the directory.
~/.ssh: should be 700.
Getting a 403 after a deploy?
If nginx or Apache returns 403 Forbidden, check every directory on the path with namei -l /var/www/example.com/index.html. One directory at 700 or 644 is enough to block the server, and setting it to 755 usually fixes it.
Related modes
- chmod 644: the matching file mode.
- chmod 750: the same, minus access for others.
- chmod 775: the group can also write.
- chmod 777: what not to use instead.
Change individual bits in the chmod calculator to see the octal and symbolic forms.