# How do I set permissions for a web server directory?

**URL:** <https://community.nginx.org/t/how-do-i-set-permissions-for-a-web-server-directory/4631>\
**Category:** NGINX\
**Tags:** permissions, web-server\
**Created:** [June 2, 2025, 12:51pm UTC](https://community.nginx.org/t/how-do-i-set-permissions-for-a-web-server-directory/4631 "2025-06-02T12:51:29Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://community.nginx.org/u/hack3rcon)\
**Post date:** [June 2, 2025, 12:51pm UTC](https://community.nginx.org/t/how-do-i-set-permissions-for-a-web-server-directory/4631/1 "2025-06-02T12:51:29Z")

</div>

Hello,  
I have three websites that exist in the following directory:

```auto
$ ls /var/www/html/
branch-view portal portal-view

```

The portal directory is the `Laravel` project and the other two are `React`. In Laravel project, the user has to upload the file and its directory is `/var/www/html/portal/storage`.

I did:

```auto
# /sbin/usermod -aG www-data devops
# chmod -R g+w /var/www/html
# chmod g+w /var/www/html/*
# chmod -R 777 /var/www/html/portal/storage
# newgrp www-data

```

On the internet I found the following advice:

```auto
Assign the Nginx user as the owner of your website files:

# chown -R www-data:www-data /var/www/html

Directories: 755 (read/execute for others):

# find /var/www/html -type d -exec chmod 755 {} \;

Files: 644 (read-only for others)

# find /var/www/html -type f -exec chmod 644 {} \;

```

How do I apply the correct permission?

Thank you.

---

<div class="post-metadata">

**Author:** ![heo](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/heo/32/5_2.png) [@heo](https://community.nginx.org/u/heo)\
**Post date:** [June 2, 2025, 2:34pm UTC](https://community.nginx.org/t/how-do-i-set-permissions-for-a-web-server-directory/4631/2 "2025-06-02T14:34:46Z")

</div>

Hi there! I’ve moved your post over to #"How Do I...?" so that you are more likely to receive the help needed. Thanks!

---

<div class="post-metadata">

**Author:** ![davemc](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/davemc/32/24_2.png) [@davemc](https://community.nginx.org/u/davemc)\
**Post date:** [June 2, 2025, 3:32pm UTC](https://community.nginx.org/t/how-do-i-set-permissions-for-a-web-server-directory/4631/3 "2025-06-02T15:32:54Z")

</div>

> [@hack3rcon](#):
>
> Hello,  
> I have three websites that exist in the following directory:
> 
> ```auto
> $ ls /var/www/html/
> branch-view portal portal-view
> 
> ```
> 
> The portal directory is the `Laravel` project and the other two are `React`. In Laravel project, the user has to upload the file and its directory is `/var/www/html/portal/storage`.
> 
> I did:
> 
> ```auto
> # /sbin/usermod -aG www-data devops
> # chmod -R g+w /var/www/html
> # chmod g+w /var/www/html/*
> # chmod -R 777 /var/www/html/portal/storage
> # newgrp www-data
> 
> ```
> 
> On the internet I found the following advice:
> 
> ```auto
> Assign the Nginx user as the owner of your website files:
> 
> # chown -R www-data:www-data /var/www/html
> 
> Directories: 755 (read/execute for others):
> 
> # find /var/www/html -type d -exec chmod 755 {} \;
> 
> Files: 644 (read-only for others)
> 
> # find /var/www/html -type f -exec chmod 644 {} \;
> 
> ```
> 
> How do I apply the correct permission?
> 
> Thank you.

Let me try to see if I can shed any light. Note: I am _not_ and NGINX guru _nor_ a Laravel guru.

NGINX will need to read and serve all files. Laravel (PHP-FPM) has to read and serve the `storage` directory. At the same time, we need to think about security and DevOps access.

You added `devops` to the `www-data` group.  
You gave full write permission to all the files and directories. This might be a security risk.  
You gave everyone open permissions to `storage`. This is not optimal.  
The `newgrp` command does not affect NGINX (practical for terminal access, though).

So, changing things around, you can try:

1. Set the correct ownership  
`sudo chown -R www-data:www-data /var/www/html`

2. Set base permissions for directories (owner: `rwx`, group: `rx`, others: `rx`)  
`sudo find /var/www/html -type d -exec chmod 755 {} \;`

3. Set base permissions for files (owner: rw, group: r, others: r)  
`sudo find /var/www/html -type f -exec chmod 644 {} \;`

4. Grant write permissions for Laravel’s storage directory (owner/group: `rwx`, others: `rx`)  
`sudo chmod -R 775 /var/www/html/portal/storage`

5. Make all directories executable for the web server (important for navigation)  
This was implicitly handled by 755 for directories, but it’s good to double-check  
`sudo find /var/www/html -type d -exec chmod a+x {} \;`

6. Allow devops user (via www-data group) to write to website files  
This makes directories have rwx for group and files have rw for group  
`sudo find /var/www/html -type d -exec chmod g+w {} \;`  
`sudo find /var/www/html -type f -exec chmod g+w {} \;`

Optional: Set the `setgid` bit on directories so new files/dirs inherit the `www-data` group  
`sudo find /var/www/html -type d -exec chmod g+s {} \;`

Restart NGINX and Laravel.

Please let me know if this works or if there are any other blockers.

davemc

---

<div class="post-metadata">

**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://community.nginx.org/u/hack3rcon)\
**Post date:** [June 2, 2025, 3:47pm UTC](https://community.nginx.org/t/how-do-i-set-permissions-for-a-web-server-directory/4631/4 "2025-06-02T15:47:51Z")

</div>

Hello,  
Thank you so much for your reply.  
I will test it and inform you.

---

<div class="post-metadata">

**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://community.nginx.org/u/hack3rcon)\
**Post date:** [June 3, 2025, 6:11am UTC](https://community.nginx.org/t/how-do-i-set-permissions-for-a-web-server-directory/4631/5 "2025-06-03T06:11:28Z")

</div>

Hello,  
I did:

```auto
$ sudo chown -R www-data:www-data /var/www/html
$ sudo find /var/www/html/branch-view -type d -exec chmod 755 {} \;
$ sudo find /var/www/html/branch-view -type f -exec chmod 644 {} \;
$ sudo find /var/www/html/branch-view -type d -exec chmod a+x {} \;
$ sudo find /var/www/html/branch-view -type d -exec chmod g+w {} \;
$ sudo find /var/www/html/branch-view -type f -exec chmod g+w {} \;
$ sudo find /var/www/html/branch-view -type d -exec chmod g+s {} \;

```

After this, the permission is as follows:

```auto
$ ls -l
total 12
drwxrwxr-x 16 www-data www-data 4096 Jun 1 22:58 branch-view

```

Then:

```auto
$ nohup npm run dev > next.log 2>&1 &
$ cat next.log 
nohup: ignoring input

> vristo-next@0.1.0 dev
> next dev -p 3001

sh: 1: next: Permission denied

```

This means the permission was not applied correctly:

```auto
$ ls -l /var/www/html/branch-view/node_modules/.bin/next
lrwxrwxrwx 1 www-data www-data 21 May 31 23:10 /var/www/html/branch-view/node_modules/.bin/next -> ../next/dist/bin/next

```

I used the following command to fix the problem:

```auto
$ sudo chmod +x /var/www/html/branch-view/node_modules/.bin/next

```

---

<div class="post-metadata">

**Author:** ![davemc](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/davemc/32/24_2.png) [@davemc](https://community.nginx.org/u/davemc)\
**Post date:** [June 3, 2025, 3:47pm UTC](https://community.nginx.org/t/how-do-i-set-permissions-for-a-web-server-directory/4631/6 "2025-06-03T15:47:44Z")

</div>

Did this correct your problem, and are you now able to run?

davemc

---

<div class="post-metadata">

**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://community.nginx.org/u/hack3rcon)\
**Post date:** [June 3, 2025, 3:52pm UTC](https://community.nginx.org/t/how-do-i-set-permissions-for-a-web-server-directory/4631/7 "2025-06-03T15:52:05Z")

</div>

Hello,  
Thanks again.  
Yes. In your opinion, is everything OK?

---

<div class="post-metadata">

**Author:** ![davemc](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/davemc/32/24_2.png) [@davemc](https://community.nginx.org/u/davemc)\
**Post date:** [June 3, 2025, 10:20pm UTC](https://community.nginx.org/t/how-do-i-set-permissions-for-a-web-server-directory/4631/8 "2025-06-03T22:20:18Z")

</div>

As far as I can tell.

Glad it all worked out. And I hope to see you around the forum again!

davemc

---

<div class="post-metadata">

**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://community.nginx.org/u/hack3rcon)\
**Post date:** [June 4, 2025, 6:53am UTC](https://community.nginx.org/t/how-do-i-set-permissions-for-a-web-server-directory/4631/9 "2025-06-04T06:53:29Z")

</div>

Hello,  
Thanks again.  
What happens if the permissions of the files and directories are `root` or `devops`? For example:

```auto
$ ls -l
total 12
drwxrwxr-x 16 root root 4096 Jun 1 22:58 branch-view

```

Can’t users view the website through a browser?

---

<div class="post-metadata">

**Author:** ![alessandro](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/alessandro/32/4836_2.png) [@alessandro](https://community.nginx.org/u/alessandro)\
**Post date:** [June 4, 2025, 1:29pm UTC](https://community.nginx.org/t/how-do-i-set-permissions-for-a-web-server-directory/4631/10 "2025-06-04T13:29:24Z")

</div>

If NGINX can read the files, users should be able to view the website from any browser. Whether that can happen if you set the permissions to `root` or `devops` fundamentally depends on how you setup your user/group permissions.

---

<div class="post-metadata">

**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://community.nginx.org/u/hack3rcon)\
**Post date:** [June 5, 2025, 8:42am UTC](https://community.nginx.org/t/how-do-i-set-permissions-for-a-web-server-directory/4631/11 "2025-06-05T08:42:05Z")

</div>

Hello,  
Thank you so much.

---

<div class="post-metadata">

**Author:** ![system](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/system/32/19_2.png) [@system](https://community.nginx.org/u/system)\
**Post date:** [July 18, 2025, 1:36pm UTC](https://community.nginx.org/t/how-do-i-set-permissions-for-a-web-server-directory/4631/12 "2025-07-18T13:36:07Z")

</div>

Closed on July 18, 2025, 1:36pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.