File Permission Checker

What it does

Walks the WordPress install checking directories against the standard 755 baseline and files against 644, specifically flags wp-config.php if it's group- or world-readable, and calls out any directory (such as uploads) left group-writable or world-writable beyond what's actually needed.

Install

This skill isn't packaged in an installable registry. It's a plain SKILL.md file you can copy directly. Copy it from the SKILL.md tab and save it at the path for your assistant:

Use it in your AI assistant

Claude Code

.claude/skills/file-permission-checker/ (or ~/.claude/skills/file-permission-checker/ for all projects)

GitHub Copilot (VS Code)

.github/skills/file-permission-checker/

OpenAI Codex

.codex/skills/file-permission-checker/

Cursor

.cursor/skills/file-permission-checker/ (or ~/.cursor/skills/file-permission-checker/ globally)

Compatibility

Any WordPress site with shell or SFTP access to run a permissions scan; a hosting control panel file manager works as a fallback for smaller checks.

The complete SKILL.md for this skill:

---
name: file-permission-checker
description: Use when a user wants a file permissions audit, asks if wp-config.php is exposed, or is troubleshooting a security scan flag related to file/folder permissions.
---

# File Permission Checker

## When to use
The user wants to confirm WordPress core, theme, and plugin files aren't left with overly permissive access, especially after a shared hosting setup, a migration, or a security scanner flagged a permissions issue.

## Procedure
1. Check directory permissions against the recommended baseline (755, owner read/write/execute, group and world read/execute only) across wp-admin, wp-includes, and wp-content.
2. Check file permissions against the baseline (644, owner read/write, group and world read only), flagging any file with write access open to group or world.
3. Specifically check wp-config.php for whether it's readable beyond the owner, since it holds database credentials and secret keys.
4. Check the uploads directory and any custom upload paths for unnecessary write access beyond what the web server user needs.
5. Note the difference between what's needed for the site to function (e.g. some plugins do need certain directories writable) versus what's simply left over-permissive.
6. Report each finding with the current permission, the recommended one, and the exact chmod command to fix it, letting the user or their host apply it.

## Guardrails
- Never run the permission-fixing commands automatically, only report findings and the recommended command, since incorrect permissions changes can break the site outright.
- Do not display the contents of wp-config.php or any credentials while checking its permissions, only report whether the file's access level is safe.