chmod 644

rw-r--r--Safe when used as intended

Owner can read and write; everyone else can read.

644 is the standard mode for regular files. The owner can read and write; the group and everyone else can only read. Nobody can execute it.

It's what new files get under the common umask of 022, and it's the right mode for web content: the web server can read your HTML, CSS and images, but can't modify them.

Permission by permission

Who	Read	Write	Execute	Digit	Means
owner	✓	✓	—	6	read and write
group	✓	—	—	4	read only
others	✓	—	—	4	read only

In ls -l: -rw-r--r-- for a file, drw-r--r-- for a directory.
Symbolic form: u=rw,g=r,o=r
New files get this mode when the umask is 022.

Use it for

Regular files: HTML, CSS, images, documents.
Config files that contain no secrets.
Public SSH keys (id_ed25519.pub).

Avoid it for

Secrets — .env files, private keys, credentials. Everyone can read them; use 600 or 640.
Scripts that must run directly: use 755.
Directories: without execute nobody can enter them; use 755.

Commands

chmod 644 path

set this mode on a file or directory

chmod u=rw,g=r,o=r path

the same, written symbolically

find path -type f -exec chmod 644 {} +

apply it to every file in a tree, leaving the directories alone

stat -c '%a %A %n' path

check the current mode on Linux (macOS: stat -f '%Lp %Sp %N' path)

Try variations

Mode — octal or ls -l form

644

-rw-r--r--

Who	read	write	execute	Digit
owner				6
group				4
others				4

setuid— run as the file's ownersetgid— run as / inherit the groupsticky— only owners delete entries

The owner can read and write; the group can read only; everyone else can read only.

chmod 644 file

chmod u=rw,g=r,o=r file

Read the full guide to chmod 644 →

Frequently asked questions

What does chmod 644 do?

It gives the owner read and write (6), and read only (4) to the group and to everyone else. In ls -l it shows as rw-r--r--.

644 or 755 for WordPress files?

644 for files and 755 for directories. wp-config.php should be tighter — 640 or 600 — because it holds database credentials.

Why does ssh say 'UNPROTECTED PRIVATE KEY FILE' with 644?

Private keys must not be readable by others. Use 600 (or 400) for private keys; 644 is only right for the .pub file.