Fix FTP Write Permission Denied on LEMP Server

If you’re running a LEMP (Linux, Nginx, MySQL, PHP) server and getting “Permission denied” when uploading files via FTP, the issue is almost always a mismatch between the FTP user’s ownership/group and the web server’s user (usually www-data). This guide walks you through diagnosing and fixing the permissions so you can upload and edit files without breaking security.

What You’ll Need

• Root or sudo access to your server via SSH
• An FTP client (e.g., FileZilla) for testing
• Basic familiarity with the command line

Step-by-Step

1. Identify the Web Server User
   Run ps aux | grep nginx to see which user Nginx runs as. Typically it’s www-data on Debian/Ubuntu. Note this user; you’ll need it later.
2. Check Current Ownership and Permissions
   Navigate to your web root (e.g., /var/www/html) and run ls -la. Look at the owner and group of the files and directories. If they’re owned by root or another user, that’s likely the problem.
3. Determine Your FTP Username
   You need to know which system user you log in as via FTP. If you’re using a virtual FTP user (e.g., Pure-FTPd with MySQL), the files may be owned by a specific system user like ftpuser. If unsure, check your FTP server config or the home directory path.
4. Change Ownership to the FTP User
   If the FTP user is a real system user, change ownership of the web files to that user. For example, if your FTP user is john, run:
   sudo chown -R john:www-data /var/www/html
   This makes john the owner (so he can write) and www-data the group (so Nginx can read).
5. Set Directory Permissions
   Directories need execute permission to be traversed. Set them to 755 (owner rwx, group r-x, others r-x) or 775 if you need group write. Run:
   sudo find /var/www/html -type d -exec chmod 755 {} \;
6. Set File Permissions
   Files typically need 644 (owner rw, group r, others r). Run:
   sudo find /var/www/html -type f -exec chmod 644 {} \;
7. If Using a Virtual FTP User with a Different System User
   If your FTP user maps to a system user like ftpuser that isn’t the owner, you can either change the FTP server config to map to the web user, or add the FTP system user to the www-data group and set group write permissions. For example:
   sudo usermod -a -G www-data ftpuser
   Then set group write on directories: chmod 775 for directories and 664 for files.
8. Test FTP Upload
   Try uploading a file via FTP. If it works, great. If not, proceed to Troubleshooting.

Common Mistakes

• Setting 777 permissions – This is a security risk and often unnecessary. Avoid it unless you’re troubleshooting and will revert immediately.
• Ignoring the group – The group matters because Nginx needs read access. If the group is wrong, Nginx can’t serve files.
• Forgetting to apply changes recursively – Newly uploaded files might inherit the parent directory’s permissions, but existing files need the -R flag or find.
• Using the wrong web server user – On CentOS it’s nginx, not www-data. Always verify.
• Not checking SELinux – If SELinux is enforcing, file permissions alone won’t fix it. You may need to adjust contexts.

Tips

• Use a dedicated FTP user that is the owner of the web files. This avoids mixing permissions.
• Set the setgid bit on directories so new files inherit the group. For example: chmod g+s /var/www/html.
• For WordPress or similar CMS, you might need to allow PHP to write to certain directories (like wp-content/uploads). In that case, set the group to www-data and give group write on those specific directories.
• Use SFTP instead of FTP for better security, but the same permission principles apply.

Troubleshooting

• Still getting “Permission denied”? Check if the FTP user is chrooted to a directory that doesn’t include your web root. If so, you may need to adjust the FTP server’s chroot settings.
• Check the exact error message – If it says “550 Permission denied”, it’s a server-side permission issue. If it says “553 Could not create file”, it’s also permissions. If it says “530 Login incorrect”, that’s an authentication issue, not permissions.
• Verify the FTP user’s home directory – If the FTP user’s home is /home/ftpuser and you’re trying to write to /var/www/html, the user may not have access to that path. You can symlink or mount the web root into the home directory.
• Check for SELinux – On RHEL/CentOS, run getenforce. If it returns Enforcing, you may need to set the correct context: sudo chcon -R -t httpd_sys_rw_content_t /var/www/html.
• Test with a simple file – Create a test file via SSH and try to overwrite it via FTP. This isolates whether the issue is with the FTP server or the filesystem.
• Check Nginx configuration – If Nginx is running as a different user than www-data, adjust the ownership accordingly.

Frequently Asked Questions

Why does Nginx need write permission to my files?

Nginx doesn’t usually need write permission; it needs read and execute. But PHP-FPM (which processes PHP files) often runs as www-data and may need write access to certain directories (like uploads or cache). The FTP user needs write permission to upload, so the owner should be the FTP user, and the group should be www-data with read access.

What’s the difference between chown and chmod?

chown changes the owner and group of a file. chmod changes the permission bits (read, write, execute) for the owner, group, and others. You need both: correct ownership and correct permission bits.

Can I just use 777 permissions to fix it?

Technically yes, but it’s a severe security risk. Any user on the system (or via a compromised service) can write to those files, potentially defacing your site or injecting malware. It’s better to set proper ownership and use 755/644 or 775/664.

Why does the FTP user not own the files after I upload?

If the FTP server creates files with a different user (e.g., the FTP server runs as ftp), the files may be owned by that user. Check your FTP server configuration to ensure it uses the logged-in user’s UID/GID.

How do I make new files automatically have the correct group?

Set the setgid bit on the directory: chmod g+s /var/www/html. Then new files will inherit the directory’s group, which should be www-data.

What if I use a control panel like Plesk or cPanel?

Control panels often manage their own permission schemes. In that case, use the panel’s file manager or its built-in tools to fix permissions, as manual chown may conflict with the panel’s settings.

Related

• Apache Virtual Hosts: Fix Default Page
• Red Safe Code in Call of Duty: Modern Warfare
• Fix 0x80004005 Error in Windows Repair