Suggested permissions for website files

Question

As the title suggests, I am curious as to the suggested file/directory permissions for HTML, CSS, Javascript, PHP, etc files on a website.

Prior to today, I have never really thought about it because I used FileZilla on my Windows computer, and it seemed to take care of permissions just fine. I recently switched to Mac, and am using Cyberduck for FTP now, but it seems either I set something wrong somewhere or it bungled permissions, and now you can't access the website I am working on.

What do you say? (and for ease of reading, please don't just post an octal number.)

Answer 1

Depends on several factors. It sounds like you are probably running something like Apache which reads in HTML files in a directory, then serves them through a webserver. If this is the case, the files need to have permissions such that Apache can read them, so for example you could make them world-readable, or if you wanted to, you could assign them to a UNIX group that whatever user runs Apache is also a member of.

Answer 2

There are some Apache configuration options which may impact what permissions you need to have on your files. Here are some things to check:

1. Most shared hosting uses Apache in a mode where your website uses your own logon identity to serve files and run scripts (SuexecUserGroup, suEXEC). If this is the case for your host then only the first number of the permissions is relevant. If it's not the case, you may need to set the group and/or world values to at least 4 (eg. 644 which is rw-r--r-- - check Wikipedia for a quick intro).
2. If your host is using suEXEC then it may be prevented from serving files which are executable for anything other than your own user.
3. Remember that you should have the execute bit set on any directories