Permissions that are correct, not just working

Every "permission denied" has a correct answer and a dangerous one. The dangerous one is 777, it always works, and it means any process on the server can rewrite your code.

What the three digits are

Owner, group, everyone else. Read is 4, write is 2, execute is 1, and they add up: 6 is read and write, 7 is all three.

• 644 on a file - the owner writes, everyone reads.
• 755 on a directory - the owner writes, everyone can enter and list.
• 600 on a secret - the owner, and nobody else at all.

What a site needs

find . -type d -exec chmod 755 {} \;\nfind . -type f -exec chmod 644 {} \;\nchmod 600 wp-config.php

Directories need execute to be entered; files do not need it at all. A PHP file with 755 is not more runnable - the web server reads it, it does not execute it as a program.

Ownership is the part that is usually wrong

The error is often not the mode but the owner. If PHP runs as one user and the files belong to another, no mode short of 777 will help - and the right fix is the owner.

ps aux | grep php-fpm | head -2\nchown -R youruser:youruser /path/to/site

Stop uploads executing

location ~* /uploads/.*\.php$ {
    deny all;
}