So, I'm not sure what are the recommended directory ownership and premissions for directories of my websites.

└── var
    └── www
        ├── website1
        │   └── public_html
        └── website2
            └── public_html

So the owner of var and www is already root:root.

└── [root     root    ]  var
    └── [root     root    ]  www
        ├── [user1     user1    ]  website1
        │   └── [user1     user1    ]  public_html
        └── [user2     user2    ]  website2
            └── [user2     user2    ]  public_html

It should be like above?


└── [root     root    ]  var
    └── [root     root    ]  www
        ├── [root     root    ]  website1
        │   └── [user1     user1    ]  public_html
        └── [root     root    ]  website2
            └── [user2     user2    ]  public_html

For premissions i did like this:

└── [drwxr-xr-x]  var
    └── [drwx--x--x]  www
        ├── [drwxr-xr--]  website1
        │   └── [drwxr-xr-x]  public_html
        └── [drwxr-xr--]  website2
            └── [drwxr-xr-x]  public_html

For better orientation:

var 0755
www 0711
website1 0754
public_html 0754 or 0755

Any suggestion?

  • 1
    It very much depends on what your websites do. Do they have any upload functions? If so, you'll need to make sure that an appropriate user can write to specific folders. That might include auto update functions in some CMS. Do you have any symlinks in any of these folders? Can users create them if not?
    – Matthew
    Mar 10, 2016 at 7:25
  • Wordpress, Drupal, osCommerce etc.
    – Mirsad
    Mar 10, 2016 at 7:41
  • All of these support upload functions of various kinds, and are known to have third party plugins which have previously caused security issues. Furthermore, they all use subdirectories, which aren't covered by the items you've listed. Are you trying to prevent users from uploading to other folders?
    – Matthew
    Mar 10, 2016 at 8:51

1 Answer 1


Giving the information you have provided:

I would always suggest that the user for your web application is www-data:www-data and the file permissions be NO HIGHER than 755.

if you are creating split hosting then yes of course you can user different users, www-data is just a common user to use, though set up correctly you can user basic users. never use root. if you need special privileges give your user specific powers (sudoers), not let that user have all the power.

With anything below your document root, in this case this would include your www folder (unless you have web assets stored there), I would keep the file permissions to another user, I would always advise against root but it wouldn't be so bad at this level.

You need to remember anything executed as root is dangerous regardless if you think you server is safe. your server isn't safe.

My tip is to keep root out of the picture as much as possible. I hope this helps.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .