File permissions: 644 and 755

On our shared hosting, the file permissions you want are simple: directories at 755 and regular files at 644. That pattern lets your account own and run the site while keeping other users from writing into your tree. WordPress does not need 777, and wp-config.php should stay at 640 or 644—never world-writable.

Who owner, group, and other really are

Each permission set applies to the owner, the group, and everyone else. On cPanel with LiteSpeed and CloudLinux, your account user owns the files, and PHP runs as that same user. WordPress can update plugins and accept uploads because it is the owner, not because the world can write. CageFS already keeps neighboring accounts out of your home directory, so you do not need world-writable bits for normal site work.

New files created over SFTP follow your umask. A loose umask can leave 666 or 777 modes that stay wrong until you fix them. After a backup restore, modes can also arrive as 000 or 777 depending on how the archive was packed. Check ownership first, then set the modes; chmod alone will not fix a tree owned by the wrong user.

Find world-writable directories and files

Use find from your home directory to list anything other users can write. Start with directories under public_html:

find ~/public_html -type d -perm -0002 | head

Anything this prints is writable by other. Run the same idea with -type f for files. Keep wp-content/uploads at 755. Prefer 640 on wp-config.php when you can so other accounts cannot read it. Never leave a backup.sql sitting in the web root at any mode.

After restores, malware, and toolkit uploads

WP Toolkit and the cPanel File Manager create files as your account user, which is correct. Trouble often starts when a zip from a laptop unpacks everything as 777, or an rsync brings in ownership from another server. Spot-check wp-content/uploads and wp-config.php after every restore. Set ownership first, then apply 755 on directories and 644 on files.

After malware cleanup, permissions are only one layer. A webshell at 644 still runs as you, so remove the shell and rotate secrets before you lock the tree down. Correct 755 and 644 modes then stop the next write from becoming world-writable again.