My environment is an AWS EC2 machine, with only one magento 2.2.3 store, with apache and Mysql. I've followed a few posts here from stackoverflow (here and here) and oficial documentation, but I'm not sure if I got all we need here. I've been setting my folder permissions as:

sudo find . -type f -exec chmod 740 {} \;
sudo chmod u+x bin/magento;
sudo find . -type d -exec chmod 750 {} \;
./var/view_preprocessed \( -type d -or -type f \) -exec chmod 777 {} \;
sudo find ./pub/media -type d -exec chmod 775 {} \;
sudo find ./pub/static \( -type d -or -type f \) -exec chmod 775 {} \;
sudo find app/code lib pub/static app/etc generated/code generated/metadata var/view_preprocessed \( -type d -or -type f \) -exec chmod g-w {} \; && chmod o-rwx app/etc/env.php;
sudo find . -maxdepth 1 -type f -exec chmod g-wr {} \;
sudo chmod g+rx index.php .htaccess composer.json composer.lock && sudo chmod g-w .;

My question is, is this file permissions secure? There is something to get better, if so, why?

2 Answers 2


Magento 2 System Permission.

Try to give outer root folder 755 & make all files & folder will be also 755 excluded pub/static, pub/media, var/, generated/.

Make those folder 777 permission after

php bin/magento setup:static-content:deploy -f (if production mode)
  • It doesn't seems to be a secure permissions for production environment.
    – lpFranz
    May 25, 2018 at 11:36
  • It is right permission if you are in production env. you have to give 777 for static files as those are dynamically generated.
    – MR.R DNATH
    May 25, 2018 at 22:59

Better to give full permission for magento root folder

Linux system :

  chmod -R 0777 *your_path/magento

windows system : In apache server, we need to give full permission for that folder.

 <Directory /var/www/html/example-magento.com>
        Options Indexes FollowSymLinks
         AllowOverride All
         Require all granted
  • 1
    Is for production, 777 doesn't seems to be correct in such cases.
    – lpFranz
    May 25, 2018 at 11:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.