What does chmod 644 mean? File permissions for web servers, configs, and static content
644 is the correct default for all non-executable files. It's what your text editor sets when you create a new file (subject to umask). If a file doesn't need to be run as a program and doesn't contain secrets, 644 is almost certainly the right permission.
chmod 644 sets permissions to rw-r--r--: the owner can read and write, and the group and everyone else can only read. This is the standard permission for static files on web servers, configuration files, documents, and any file that should be viewable but not executable or editable by others.
By TechCompare · Updated
How this is calculated
In octal, 6 = 4+2+0 (read+write). 4 = 4+0+0 (read-only). 644 is safe because it prevents both accidental execution and unauthorized modification. On a web server, setting PHP or Python files to 644 ensures they can be read by the web server process but not written to if the server is compromised. Paired with 755 on directories, 644 on files creates a sensible security baseline for any shared or web-facing system.
Verdict
The octal splits as 6 (4+2, read+write) for the owner and 4 (read-only) for both group and others, which is the result of the standard umask 022 against a file-creation mode of 0666. Stripping the execute bit is the safety feature: a static web file or config file at 644 cannot accidentally be run as a script even if an attacker drops a malicious payload in it, which would not be true of a 755 file. The same logic explains why 644 is the wrong choice for files holding secrets: 'others' can read them, so SSH keys, .env files, and credential stores need to drop further to 600 where the group and others bits go to zero.