Magento 2 File and Folder Permissions [Complete Guide]

File and folder permissions decide who can read, write, and execute the files that make up your Magento 2 store — get them wrong and you either break the site (permission-denied errors) or expose it (world-writable files an attacker can modify). This guide covers the default permissions, how to set them safely with umask and chmod, the correct values for files, folders, and media directories, and how to fix the most common permission errors.

You can set permissions either from the command line (terminal) or through your hosting provider's file manager. We'll use the command line throughout.

What Are the Default Magento 2 File and Folder Permissions?

When a file or folder is created, the system assigns it default permissions — and those defaults can be more open than you want for files holding private or business-critical data. A file or folder with 777 permissions, for example, grants read, write, and execute to everyone, which means anyone with access to the server can read or modify it.

To view current permissions, run ls -li in the directory you want to inspect:

ls -li

This lists every file and folder with its permission flags, owner, group, size, and last-modified time. The second column is the permission flag — for example drwxrwxrwx — which describes the access for a given file or directory. Here's how to read those ten characters:

There are two commands for setting permissions in Magento 2: umask (controls the defaults for newly created files) and chmod (changes permissions on existing files). Let's look at each.

How to Set Magento 2 Permissions

1. Modifying Permissions with umask

When a file is created, its permission flags are set according to the file mode creation mask, defined by the umask command. The umask is a three-digit octal value whose bits map to the permission flag fields. Some commonly used umask values:

2. Modifying Permissions with chmod

The chmod (change mode) command changes permission flags on existing files. It can be applied recursively with the -R option, and accepts either an octal value or symbolic flags. Here's what each octal digit means:

How to Set Magento 2 File Permissions via CLI

In Magento, files should generally have 640 or 644 permissions — the owner and group can read (and the owner write), while the world only reads. From your Magento root:

find . -type f -exec chmod 644 {} \;

How to Set Magento 2 Folder Permissions via CLI

Directories should generally have 750 or 755 permissions — read, write, and execute for the owner, read and execute for the group, and (for 755) read/execute for others:

find . -type d -exec chmod 755 {} \;

Media and pub/static Folder Permissions

The writable directories — /var, /pub/static, /pub/media, and /generated — need to be writable by the web server. Many tutorials reach for 777 here, and you'll see it work:

find ./var -type d -exec chmod 777 {} \;
find ./pub/static -type d -exec chmod 777 {} \;
find ./pub/media -type d -exec chmod 777 {} \;

A security warning about 777: 777 makes these directories world-writable, meaning any user or process on the server can modify their contents — a real risk, and one Magento's own security guidance advises against on production. The safer approach is to make the directories group-writable and set the correct ownership so the web server and your deployment user share a group:

# Safer than 777: group-writable + correct ownership
chown -R :<web-server-group> var pub/static pub/media generated
find var pub/static pub/media generated -type d -exec chmod 2775 {} \;
find var pub/static pub/media generated -type f -exec chmod 664 {} \;

Use 777 only as a temporary diagnostic step on local/dev, and tighten it back down before going live.

How to Troubleshoot Common Magento Permission Errors

bash: bin/magento: Permission denied

This appears when you try to run a script that lacks execute permission. Give the file the execute bit:

• Open your terminal (shell).
• Navigate to the folder containing the script.
• Add execute permission:

chmod +x path_to_file/file_name

# For the Magento CLI specifically:
chmod u+x bin/magento

Magento 2 File Permission Check Failed

The Web Setup Wizard shows this when directories aren't writable by the web server user. First, confirm the prerequisites:

• You know your Magento install path (e.g., /var/www/html/magento).
• You have command-line access.

Then, from your Magento root, make the writable directories accessible to the web server. Again, prefer group-writable ownership over 777:

cd /var/www/html/magento

# Preferred: correct ownership + group-writable
chown -R :<web-server-group> var generated pub
find var generated pub -type d -exec chmod 2775 {} \;

# Only if the above isn't possible (e.g. quick local fix):
# sudo chmod -R 777 var generated pub

How to Reset File and Folder Permissions to Magento Defaults

To reset to Magento's recommended defaults, run these from your Magento root directory:

cd <your Magento install dir>
find . -type f -exec chmod 644 {} \;
find . -type d -exec chmod 755 {} \;
chmod 644 ./app/etc/*.xml
chown -R :<web-server-group> .
chmod u+x bin/magento

Wrapping Up

Correct permissions keep Magento 2 both functional and secure: 644 for files, 755 for directories, group-writable ownership for the var/pub/generated paths, and 777 avoided on anything customer-facing. Get the ownership right and most "permission denied" and "check failed" errors disappear.

Permissions and server hardening are easy to get subtly wrong, and the cost shows up as downtime or a breach. If you'd rather not manage it yourself, our Magento 2 development team can audit and lock down your store's permissions, ownership, and server configuration. You can also reach out to our Magento development specialists or contact us for tailored guidance.