Nginx: open() failed (13: Permission denied)

Quick fix

Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.

# Check Nginx worker user
grep 'user' /etc/nginx/nginx.conf
# Fix file permissions
sudo chown -R www-data:www-data /var/www/html
sudo chmod -R 755 /var/www/html
# Fix log permissions
sudo chown www-data:adm /var/log/nginx/*.log

How to diagnose WebServer errors

Web server errors are usually about permissions, binding, or configuration that was never loaded. A common trap: the server runs as an unprivileged user (www-data, nginx), so it needs execute permission on every directory in the path to a file, not just read permission on the file itself. Another: editing a config file changes nothing until the server is reloaded and the file is actually included.

If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.

1. Validate configuration before reloading: nginx -t, apachectl configtest, caddy validate. This catches syntax errors without dropping traffic.
2. Dump the fully resolved configuration with nginx -T to see what is actually in effect, including every include.
3. Read the error log, not the access log, for 5xx causes. nginx names the failing upstream and the exact filesystem path it could not open.
4. For permission errors, test as the server user: sudo -u www-data cat /path/to/file. Check execute bits on every parent directory.
5. For binding failures, find the current listener with ss -tulpn | grep :80. Ports below 1024 need privileges or a capability such as CAP_NET_BIND_SERVICE.

Tools worth reaching for

• nginx -t / nginx -T
• apachectl configtest
• ss -tulpn
• tail -f error.log
• sudo -u www-data

Authoritative references

Primary documentation for this error, worth reading before applying any fix in production.

📖 nginx.org

Related WebServer errors

• Apache: .htaccess: Option Indexes not allowedDirectory listing (Options Indexes) is disabled in main config but requested in .htaccess.
• Apache: AH00558: Could not reliably determine the server's FQDNServerName is not set, so Apache guessed from the system hostname. It is a warning and the…
• Apache: mod_rewrite not enabledURL rewriting rules in .htaccess are not working because the mod_rewrite module is not loaded…
• Caddy: 502 Bad Gateway (reverse proxy)Caddy's reverse proxy cannot reach the upstream backend. The backend service may be down or…
• IIS: HTTP Error 500.19 - Internal Server ErrorIIS cannot read the web.config file due to syntax errors, missing modules, or insufficient…
• Nginx: 413 Request Entity Too LargeThe request body exceeds Nginx's client_max_body_size directive. Default is 1MB.
• Nginx: bind() to 0.0.0.0:80 failedNginx cannot bind to port 80 because it is already in use by another process (Apache, another…
• Nginx: could not build server_names_hash, increase the bucket sizeNginx sizes a hash table for server names at startup and one of your names is too long for…

See all 10 WebServer errors →

Browse other categories

• HTTP 494xx client errors, 5xx server errors, redirects, headers and protocol problems.
• JavaScript 42npm resolution, async pitfalls, hydration, memory limits and runtime type…
• Database 41Connections, deadlocks, constraints, replication and memory limits.
• AI 35Rate limits, context windows, GPU memory and model-serving failures.
• Network 35Refused connections, timeouts, resets, MTU problems and port exhaustion.
• Python 35Imports, virtual environments, encoding, concurrency and dependency conflicts.
• Kubernetes 34CrashLoopBackOff, ImagePullBackOff, OOMKilled, RBAC, scheduling and storage.
• Docker 27Daemon connectivity, disk space, image pulls, ports and architecture mismatches.
• System 26Disk space, systemd units, file descriptors, OOM killer and scheduled jobs.
• Cloud 25IAM permissions, quotas, service limits and credential failures.
• Security 25JWT validation, CSRF, OAuth grants, SELinux, SSH host keys and CSP.
• TLS 24Untrusted authorities, expiry, hostname mismatch, chains and cipher negotiation.

Something missing or wrong?

This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.