WordPress security
Use Plesk WordPress Toolkit to check permissions instead of applying blanket changes
File permissions control which server processes can read, change or run WordPress files. Incorrect values can break the site or weaken security. Start with the Toolkit security check and repair only the files or directories that need attention.
What do WordPress permissions mean?
Files and folders differ
Directories need traversal access, while files usually need only read access plus controlled write access for their owner.
Ownership matters too
A correct-looking number can still fail when files belong to the wrong system user or group.
More access is not a fix
Setting everything to 777 may hide the original problem while allowing other processes to modify the site.
Configuration is sensitive
Protect wp-config.php and never expose database credentials or security keys while troubleshooting.
Check permissions through Plesk
- 1Take a backup
Create a recovery point before changing ownership or permissions across many files.
- 2Open WordPress Toolkit
Select the affected installation and run its security-status check.
- 3Review the finding
Confirm which exact file, directory or hardening measure is being reported.
- 4Apply and test
Use the Toolkit correction where offered, then test the public site, dashboard, uploads and updates.
Diagnose the symptom before repairing
| Symptom | Check first |
|---|---|
| Cannot upload media | Uploads directory ownership, disk space and PHP limits |
| Cannot update plugins | WordPress Toolkit status, ownership and any maintenance lock |
| 403 Forbidden | Exact affected path, web-server rules and recent security changes |
| Files change unexpectedly | Administrator accounts, malware scan, vulnerable plugins and logs |
Permission questions
Should WordPress files be 644 and directories 755?
Those are common starting values, but ownership, server configuration and sensitive files also matter. Prefer Plesk’s installation-aware checks.
Is 777 ever safe?
It grants broad write access and should not be used as a routine repair. Find and correct the actual ownership or configuration problem.
Will a security check change my content?
Review the proposed measures first. Keep a backup and test the website after applying changes.
Repair with context
Use the WordPress-aware tools in Plesk
They provide a safer starting point than changing every file to the same permission.