File and folder permissions in PrestaShop: the correct configuration

When a module cannot write to a folder, the temptation is to set its permissions to 777. It works, and at the same time it lets any process on the server write there, including an attacker who has found a vulnerability.

The correct values

• Folders: 755
• Files: 644
• Configuration files (app/config/parameters.php): 640, or 600 if the server allows it.

find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;

The owner matters more than the number

PrestaShop needs to write to var/, img/, upload/, download/, themes/*/assets/cache, modules/ (to install) and translations/. If the files belong to the same user PHP runs as, 755/644 is enough. If not, the problem is ownership, not permissions.

Blocking PHP in upload folders

In folders where files are uploaded, no .php file should ever be executed. With Apache, a .htaccess in each one:

<FilesMatch "\.(?i:php|phtml|phar|pht)$">
    Require all denied
</FilesMatch>

PrestaShop 9 ships with a modules/.htaccess that denies direct access to .php files inside modules/. Modules must expose their entry points as controllers (index.php?fc=module&module=...), not as standalone PHP files.

After an update

PrestaShop updates can overwrite .htaccess and other core files. If you had security rules added by hand, check that they are still there.