chmod `750` — what does it mean?

750 is 755 with the 'everyone else' digit set to zero. It is the go-to mode when a directory or script must be usable by a specific group, typically a service account such as www-data, but invisible to every other user on the machine. On multi-user and multi-tenant servers it is a much better default than 755 for application code, because other tenants cannot even list your files.

In plain English

750

rwxr-x---

The owner can read, write and execute; group members can read and execute; all other users have no access.

Symbolic equivalent: chmod u=rwx,g=rx,o= /srv/myapp

Open 750 in the chmod calculator

What each digit in 750 means

Each octal digit is the sum of read (4), write (2) and execute (1) for one class of users. The digits are, in order, the file's owner, the file's group, and everyone else.

Class	Digit	Sum	r w x	ls -l
Owner (u)	7	4 + 2 + 1	rwx	rwx
Group (g)	5	4 + 0 + 1	r-x	r-x
Others (o)	0	0 + 0 + 0	---	---

Owner: can list the names of entries, create, rename and delete entries and enter the directory and open files by name.
Group: can list the names of entries and enter the directory and open files by name; no write.
Others: no access at all.

When to use chmod 750

Application directories owned by a deploy user and readable by the web server's group: owner deploy, group www-data.
Home directories on shared servers where a web server must reach ~/public_html but other users should not browse.
Admin scripts runnable by a group (e.g. ops) but hidden from other users, such as /usr/local/sbin/backup.sh owned by root:ops.
Directories like /etc/sudoers.d-style config folders or log directories readable by an adm group.

Security risks and gotchas

Group membership is the whole security model

Everyone in the group can read every file and run every script below a 750 directory. If the group is www-data and several sites share it, one compromised site can read the others. Use a group per application where you can.

The service must be in the group

If nginx runs as www-data and the directory's group is deploy, nginx falls into 'others' and gets nothing: 403 Forbidden. Check with id www-data and stat -c '%U:%G' DIR.

sudo chgrp -R www-data /srv/myapp

Commands

Set 750 on a directory

chmod 750 /srv/myapp

Equivalent to chmod u=rwx,g=rx,o= /srv/myapp.

Typical app tree: dirs 750, files 640

sudo chown -R deploy:www-data /srv/myapp
find /srv/myapp -type d -exec chmod 750 {} +
find /srv/myapp -type f -exec chmod 640 {} +

The web server can read everything, nobody else can see anything, and only deploy can write.

Drop access for others only

chmod o-rwx /srv/myapp

Turns 755 into 750 without touching owner and group bits.

How to check for 750

# Symbolic view
ls -ld /srv/myapp
drwxr-x---  5 deploy www-data  4096 Oct 16 09:12 /srv/myapp

# Octal view (Linux / GNU coreutils)
stat -c '%a %A %n' /srv/myapp
750 drwxr-x--- /srv/myapp

# Octal view (macOS / BSD)
stat -f '%Lp %Sp %N' /srv/myapp

The first character of the ls -l output is the file type (- regular file, d directory), followed by the nine permission characters. stat -c %a prints the octal mode directly; it only shows a fourth leading digit when setuid, setgid or the sticky bit is set.

Related chmod modes

640rw-r-----

Owner read and write, group read, others none

755rwxr-xr-x

Owner full access, everyone else read and execute

700rwx------

Owner full access, nobody else

775rwxrwxr-x

Owner and group full access, others read and execute

Try variations of 750 in the chmod calculator, browse all chmod modes, or read Linux file permissions explained for chown, umask and ACLs.

Frequently Asked Questions

What is the difference between 750 and 755?▾

With 755 every user can read and enter the directory or run the script. With 750 only the owner and members of the file's group can; everyone else gets 'Permission denied'.

Is chmod 750 good for a web root?▾

Yes, if the web server's user is in the directory's group (for example owner deploy, group www-data). It keeps other local users out while still letting the web server read and traverse it. Pair it with 640 for files.

Should files be 750?▾

Only executables that the group needs to run. Regular files under a 750 directory should be 640, which gives the group read without execute.

chmod 750 — what does it mean?