What should be file permissions in Magento 2 after deploying website to live and website is in production mode.

I have read many forums and found that the file permissions of folders generated,var and pub should be 777 but in Magento 2 documentations it is different.This create a little bit confusion so please let me know if anyone have idea about this.

When you are ready to deploy your site to production, you should remove write access from files in the following directories for improved security:

Any other static resources


We are getting issue that permissions changed automatically to root and website stopped to work.We are not able to run the Magento command without sudo.

Currently we are having ubuntu user and www-data group.

Please share your thoughts how to run Magento command without using sudo in details.We are using AWS server.

I have followed answer of this question but still permission are changed for cache and page_cache folder.It is still creating with user www-data.

enter image description here

  • Permission configuration depends on the user configuration in the target hosting environment. Shared hosting usually has a single user to run the web server, php, and file system ownership. A safer production setup in a private server environment has the file ownership as a different user than user running the web server and php. What user(s) are running the webserver, php (if not mod_apache,) and deploying Magento code? It would also be helpful to provide details on the permissions issue you are encountering.
    – Ian at SSU
    Feb 20, 2019 at 13:25
  • hello @IanatXantek,thanks for your response.Please check my updated query.
    – akgola
    Feb 21, 2019 at 4:21
  • The var/cache and var/page_cache directories are generated by Magento so ownership by the web server user looks normal. The problem is an error is thrown when trying to run the Magento CLI as magento_2 user? What is the error? It sounds like the permissions on some files in the Magento install directory are being changed to root ownership. This usually happens when deploying code as root, running Magento CLI as root, or the Magento Cron running as root. Side note: I highly suggest using Varnish for Magento 2 full page caching and Redis for Magento cache.
    – Ian at SSU
    Feb 26, 2019 at 20:58
  • hello @IanatXantek, there is not any error but why cache and page_cache folders have user as www-data,it should be magento_2?
    – akgola
    Feb 27, 2019 at 4:59
  • When Magento runs and is not using Varnish (page_cache) or Redis (cache) these directories will be created in var. If Magento was run via the web server/php-fpm the page_cache and cache directories will be created with user www-data. Since the magento_2 user is in the www-data group this ensures access to these runtime data directories. This should not relate to the reported problem of needing to run the Magento CLI with sudo unless magento_2 is not in the group www-data. If you run the Magento CLI with -vvv (for verbose) you should get an error or maybe I don't understand the question.
    – Ian at SSU
    Feb 28, 2019 at 17:46

1 Answer 1


It sounds like you are running "Two Magento file system owners in production mode"

Ensure your file system owner is in the web server group

groups magento_user
> magento_user : magento_user www-data

add file system owner "magento_user" to web server "www-data" group as primary group

usermod -g www-data magento_user

If using PHP-FPM ensure it's running as same user and group as the web server.

Ensure initial permissions are correct

cd <your Magento install dir>
chown -R :www-data .
find . -type f -exec chmod 644 {} \;
find . -type d -exec chmod 755 {} \;
chmod o-rwx app/etc/env.php
chmod u+x bin/magento
find var generated vendor pub/static pub/media app/etc -type f -exec chmod g+w {} +
find var generated vendor pub/static pub/media app/etc -type d -exec chmod g+ws {} +

For added security in production remove web server write to specific locations

find app/code lib pub/static app/etc generated/code generated/metadata var/view_preprocessed \( -type d -or -type f \) -exec chmod g-w {} +
  • hello @IanatXantek,thanks for answer.I have followed all steps but still facing the issue.Please check my updated question.
    – akgola
    Feb 26, 2019 at 4:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.