What does chmod 644 mean? File permissions for web servers, configs, and static content
644 is the correct default for all non-executable files. It's what your text editor sets when you create a new file (subject to umask). If a file doesn't need to be run as a program and doesn't contain secrets, 644 is almost certainly the right permission.
chmod 644 sets permissions to rw-r--r--: the owner can read and write, and the group and everyone else can only read. This is a common permission for static files on web servers, configuration files, documents, and files that shouldn't be directly executable or editable by others. An interpreter can still be told to read a 644 script explicitly, such as with `bash script.sh`.
By TechCompare · Updated
How this is calculated
In octal, 6 = 4+2+0 (read+write). 4 = 4+0+0 (read-only). 644 blocks direct execution through the file's execute bit and blocks writes by group and others, but it doesn't stop an interpreter from reading the file when explicitly invoked. On a web server, the handler decides whether PHP or Python content is processed, while 644 prevents the file from being written by the web-server user in the others class. Paired with 755 on directories, 644 on files creates a sensible baseline for shared or web-facing systems.
Verdict
The octal splits as 6 (4+2, read+write) for the owner and 4 (read-only) for both group and others, which is the result of the standard umask 022 against a file-creation mode of 0666. Stripping the execute bit prevents the operating system from launching the file directly as a program, although a user can still pass readable content to an interpreter such as Bash. The same logic explains why 644 is the wrong choice for files holding secrets: 'others' can read them, so SSH keys, .env files, and credential stores need to drop further to 600 where the group and others bits go to zero.