File Permissions Guide

WordPress File Permissions on BlitzPress

Correct file permissions are critical for security and functionality. Too permissive and your site is vulnerable; too restrictive and WordPress cannot function properly.

Standard WordPress Permissions

Path	Type	Permission	Reason
/home/DOMAIN/public_html/	Directory	755	Web server needs read + execute
All directories	Directory	755	Standard directory permission
All files	File	644	Owner read/write, others read-only
wp-config.php	File	640	Sensitive — restrict to owner + group
wp-content/uploads/	Directory	755	PHP needs write access via nobody

OLS User Context

OpenLiteSpeed runs PHP (lsphp) as the nobody user. For WordPress to write files (uploads, plugin updates, cache), the nobody user needs appropriate access.

On BlitzPress, file ownership is set to nobody:nogroup for the web root, so PHP can read and write files directly. This is the simplest and most common configuration for single-site servers.

Fix Permissions via SSH

# Fix directory permissions
find /home/DOMAIN/public_html -type d -exec chmod 755 {} \;

# Fix file permissions
find /home/DOMAIN/public_html -type f -exec chmod 644 {} \;

# Secure wp-config.php
chmod 640 /home/DOMAIN/public_html/wp-config.php

# Fix ownership
chown -R nobody:nogroup /home/DOMAIN/public_html/

BlitzPress Quick Fix

blitzpress site:fix-permissions DOMAIN

This command sets all standard permissions in one step.

Uploads Directory

The wp-content/uploads directory needs to be writable by PHP for media uploads. If uploads fail with a “could not create directory” error:

chmod -R 755 /home/DOMAIN/public_html/wp-content/uploads
chown -R nobody:nogroup /home/DOMAIN/public_html/wp-content/uploads

Plugin and Theme Updates

WordPress needs write access to install/update plugins and themes. If updates fail, check that the wp-content directory is writable by the PHP user (nobody).

Security Notes

• Never use 777 — this gives everyone full access and is a major security risk
• Never use 666 on PHP files — this allows anyone to modify executable code
• Keep wp-config.php at 640 or 600 — it contains database credentials
• Some security plugins recommend 444 for wp-config.php (read-only) — this is fine but prevents WP-CLI config commands