What chmod 400 means
| Class | Digit | Permissions |
|---|---|---|
| Owner | 4 | read |
| Group | 0 | no permissions |
| Others | 0 | no permissions |
Good choice for secrets such as SSH private keys, .env files and API credentials — only the owner can read them.
chmod 400 file.txt # one file
find /var/www -type f -exec chmod 400 {} + # all files in a treeHow octal permissions work
Each digit is the sum of read (4), write (2) and execute (1) for owner, group and others. So 7 = 4+2+1 = rwx, 5 = 4+1 = r-x, 4 = r--. An optional leading digit sets special bits: setuid (4), setgid (2) and sticky (1) — e.g. 1777 is /tmp.
Safe defaults for web servers
- Directories: 755
- Files: 644
- Secrets (.env, SSH keys): 600
- Laravel
storage/andbootstrap/cache/: 775 with the web server group — never 777.