UPDATE: Since the duplicate ticket on this doesn't actually answer this question I have posted this patch SUPEE-7882


Our Media folder has the files permissions set for 644 and if we switch 640 we can a 404 that image.

Problem: When we upload a file through wysisyg it saves as 640.

Host is Nexcess

I have even tested by changing the entire media folder to 777, then uploading a file.

Here is the file after uploading

-rw-r----- 1  121079 Jan 29 17:55 wagentoAfter.png

2 Answers 2


I use Nexcess, magento use 700 permissions (drwx------) for the media/ and var/ directories give full control (that is, read/write/execute) to the owner and no permissions to anyone else.

Magento expects the webserver to own the site files:


You can resolve this problem by making the webserver the owner of the files.

chown -R web-server-user-name magento/root/path

The webserver user name is commonly www-data or apache.

If you follow the instructions in the above link, the webserver will have read access to all files, and write access to media files and var files. This should be all you need for typical site operation. If you need to use Magento Connect you'll have to temporarily give the webserver write access to all files.

All file permissions are being set to CHMOD 640 which makes them inaccessible to all users.

Only the webserver user needs access to the files. There is no need to grant any permissions to all users.

You may want to grant access to a specific user if, for example, you need to edit or upload files via FTP. In this case, what I do is set a user who owns the file system and set the files' group to the webserver:

cd magento/root/directory

# Set ownership 
# 'username' should be the file system owner username
# 'webserver' should be the webserver username
chown -R username:webserver .

# Give the user read/write access to all files.
# Give the webserver read access to all files
find . -type f -exec chmod 640 {} \;
find . -type d -exec chmod 2750 {} \; 

# Give the user and the webserver read/write access to var and media
find var/ -type f -exec chmod 660 {} \;
find media/ -type f -exec chmod 660 {} \;
find var/ -type d -exec chmod 2770 {} \;
find media/ -type d -exec chmod 2770 {} \;
chmod 2770 includes
chmod 660 includes/config.php

The above commands will give your file system owner read/write access to everything and the webserver read access to everything. The webserver will also be able to write to the media and var directories.

This is a patch 7405 bug, look my search source



CREATED DATE: 2/4/16 8:44 AM Reopening this ticket because i have an issue with wysiwyg images being uploaded with the wrong permissions (this seems to be happening for all EE and CE sites that we've applied the patch on). The file isn't open enough to be able to view it on the frontend. When we go and change the permissions the image shows up. The only work around we have found for this is setting up a cron to run every 5 mins to update the permissions. Is this a bug and how do we fix it?


Thanks for re-opening the ticket. I am happy to inform you that we have SUPEE-7882 available to fix this issue. This is compatible with -


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.