What Are Permissions?

The 4 common permission layers

Web hosting commonly involves 4 permission layers, each set in a different place. Which ones your site uses depends on its setup: a static site with no logins or database, for example, has no user roles or database privileges to manage.

• File permissions control who can read, write, or execute files and directories on the server. For a WordPress site, the standard values are 644 for files and 755 for directories.
• User roles control what logged-in users can do inside an application. In WordPress, an Administrator can install plugins and delete content, while a Subscriber can only manage their own profile.
• Database privileges control what a database user can do with the data. A MySQL user granted only read access can run queries but can’t change or delete records.
• Account access controls who can log in to the hosting control panel and which settings they can manage, from domains to billing.

A fix at one layer doesn’t carry over to the others, so the first step in any access problem is working out which layer you’re in.

Read, write, and execute

On the server, a user can hold 3 permissions on a file: read, write, and execute. Read lets them view and copy the file’s contents but not change or run it. Write lets them modify the file. Execute lets them run it as a program; on a directory, execute permission is what lets someone enter it. A user granted none of the 3 can’t read, change, or run the file, and whether they can even see its name depends on the permissions of the directory that contains it.

Different classes of users hold different sets. A file’s owner might be able to read and write it while everyone else can only read, which is exactly what the common setting 644 means. Most hosting control panels include a file manager where you can view and change these values, and an FTP or SFTP client can do the same.

Mistakes at this layer are visible. Wrong file permissions are a common cause of 403 Forbidden errors and failed uploads. Opening everything up is the opposite trap: 777 grants read, write, and execute to the owner, the group, and everyone else, so any account or process on the server that can reach the file’s path can modify it. Treat 777 as a warning sign, not a fix. The file permissions entry covers the recommended values and the 3 ways to check and change them.

Sharing access without sharing your password

You don’t have to hand over your main login to get help with your site. Hosting control panels let the account owner grant a second person access to specific features instead, so a developer or bookkeeper gets their own login with a limited view. At DreamHost, this is called Account Privileges: you grant another person access to specific parts of your panel so they can edit settings there.

The rule is the same at any host: grant the narrowest access the job needs, and remove it when the work is done.

Which layer to check first

Permission errors announce themselves differently at each layer. Match the symptom to the system:

• Uploads fail or a page returns 403 Forbidden: check file permissions on the server.
• A logged-in user can’t publish, edit, or see an admin menu: check their user role in the application.
• A script or app can’t read or write its data: check the database user’s privileges.
• A collaborator can’t reach a setting in the panel: check the account access you granted them.

Each layer has its own tools, so finding the right one first saves you from changing settings that were never the problem.