File and Folder Permissions in Joomla

File system permissions determine whether Joomla can read files, upload images, write logs and install updates. Suitable settings depend on file ownership, the PHP process user and the hosting environment. Here is what to check before changing permissions and why 755 and 644 alone are not enough.

Two different permission systems

Joomla user permissions control who can view content, edit articles, upload images or install extensions. They are managed through user groups, access levels and action permissions.

File system permissions operate on the server. They control which operating system users can read, modify and execute files.

These are separate checks. Permission to upload images in Joomla cannot make a directory writable by PHP. Likewise, a writable directory does not give a visitor permission to use the Media Manager.

Being a Joomla Super User does not make someone an operating system administrator.

Understanding numeric permissions

On Linux, the three digits describe permissions for the owner, group and other users. The values are added together: read is 4, write is 2 and execute is 1.

For a directory, execute permission allows traversal to its files. Read permission allows listing names, while write permission, combined with the necessary directory access, allows creating and removing entries. A PHP file handled by the interpreter does not normally need an execute bit.

Common settings include:

• 755 for directories: the owner can modify their contents; the group and others can list and traverse them.
• 644 for files: the owner can read and modify the file; the group and others can read it.
• 444 for a file: all three categories can read it, and none has write permission.

These values describe access; they do not guarantee suitable protection. For example, 644 allows other operating system users to read a file if they can access its path.

Windows uses its own file system permissions. Linux numeric modes should not be treated as a ready-made Windows configuration.

File ownership and the PHP handler

First identify the file owner and the operating system user running PHP.

When a site has a dedicated PHP user, 755/644 often allows that owner to write. If files belong to a different account, PHP may be able to read them without being able to modify them.

In PHP-FPM, the pool settings user and group specify the worker process identity. The settings listen.owner and listen.group concern the socket used by the web server; they do not assign ownership to Joomla files.

A handler name such as CGI, FastCGI or PHP-FPM does not prove that sites are isolated. The actual process identity and hosting configuration matter. SSH sessions and scheduled jobs may also run as users different from the website’s PHP user.

Do not assign every file to www-data based on a generic recommendation. The correct account and ownership model depend on the server. Groups and file system ACLs may provide selective access; these are separate from Joomla user ACLs.

Checking access

In the Joomla administrator interface, open System Information and its directory permissions section. It reports access to the checked paths from the PHP process, rather than providing a complete security audit.

Next, use the hosting file manager or an SFTP client to inspect the affected item’s owner, group and permissions. Compare these with the PHP process identity.

With SSH access, the following GNU/Linux commands inspect specific items. Replace /srv/www/example-site with your site’s verified absolute path:

ls -ld -- /srv/www/example-site
ls -ld -- /srv/www/example-site/images
ls -l -- /srv/www/example-site/configuration.php

These commands only display information. They do not change permissions or recursively traverse directories. Quote paths containing spaces. If an item is a symbolic link, check its actual target separately.

Access checks performed through SSH apply to the SSH user. They do not establish that PHP has the same access.

Which directories need write access

Write access is needed for the operations the site actually performs:

• media uploads need access to the selected upload directory;
• file-based caching needs access to the active cache directory;
• logging needs access to the configured log directory;
• installation and updates need access to the temporary directory and the files and directories being changed.

Check the temporary and log paths in the site’s configuration. They may differ from the defaults.

If PHP cannot write application code and updates are handled by a separate deployment process, some unwritable directories may be intentional. Updating through the administrator interface then requires a separate procedure.

Do not make every directory writable simply to make all Joomla status indicators match.

Protecting configuration.php

The configuration.php file contains site settings, including database connection details. PHP must be able to read it.

Mode 444 blocks ordinary writes but does not make the file immutable. Its owner can change the mode. Permissions on the parent directory also affect whether the file can be removed or replaced.

When saving Global Configuration, Joomla may attempt to set 0644 temporarily and restore 0444 afterwards if the process owns the file. A save failure therefore calls for checking ownership and access, rather than automatically granting broader permissions.

In a suitable environment, reading can be restricted to the owner or to the owner and a dedicated group, for example with 400 or 440. Verify that PHP can still read the file and that the configuration maintenance procedure remains workable.

File permissions do not replace web server configuration. Visitors must not receive the source of configuration.php or its backups. Do not leave web-accessible .bak or .old copies, or archives containing configuration data.

Fixing permission problems

Record the original permissions, owner and group before making changes. Verify the path and confirm that the selected item belongs to the intended site.

In the file manager, change the specific file or directory involved. Do not apply permissions recursively across the site without a verified plan. Ownership changes must match the hosting setup.

Do not use blanket 777 directory permissions or 666 file permissions to resolve write errors. If ordinary permissions appear correct, check file system ACLs, PHP restrictions, server security policies, available disk space and quotas.

After a change, repeat the operation that failed. A working homepage does not demonstrate that uploads or updates have been fixed.

Key points

Secure Joomla permissions depend on file ownership, groups, the PHP process user and required operations working together. Identify the cause first, then change access only where needed. Modes 755, 644 and 444 are useful reference points, not substitutes for checking the environment.