chmod 711 (rwx--x--x)

The owner has full access; the group and others can execute (enter) but cannot read the listing.

When to use 711

Home directories on a server that runs a web server or CGI. 711 (rwx--x--x) lets the web server traverse into /home/user/public_html to serve a known file path, while the missing read bit stops anyone from listing the home directory's contents. This 'enter but don't browse' behavior is the classic shared-hosting setup.
Parent directories you must pass through but never expose. When a deep file needs to be readable but the intermediate folders shouldn't reveal their listings, 711 on the ancestors grants traversal to a known path without leaking sibling names — useful for tokenized or unguessable file URLs.
Service base directories for daemons. A directory a daemon's child processes must descend into to reach config or sockets, where listing the directory would expose other tenants' or other services' entries. 711 gives just-enough access: reach the named target, see nothing else.
Bind-mount or chroot entry points. Points others must cross to reach an allowed subtree, but whose own listing is irrelevant or sensitive.

Common mistakes & gotchas

Execute-without-read means traverse-but-not-list. The whole point of 711 is subtle: cd into the dir and cat dir/knownfile work for others, but ls dir fails with 'Permission denied'. Security here depends on the filenames being unguessable — 711 is access control by obscurity for the listing, not for the files themselves.
It does NOT hide a file once its name is known. 711 only blocks enumeration. If an inner file is world-readable (e.g. 644), anyone who knows or guesses the exact name can read it through the 711 dir. Don't rely on 711 to protect secret file contents — set the file perms accordingly.
711 on a file is almost meaningless. On a plain file, --x--x for group/others lets them execute a program they can't read — occasionally used for setuid helpers, but for ordinary scripts it just produces confusing 'cannot execute' behavior since many interpreters need read access too.
Mismatched home perms break web serving. If the home is 711 but public_html inside is 700, the web server can enter the home yet still can't read the docroot. Every directory on the served path needs at least --x for the web user.

711 vs the alternatives

755 (rwxr-xr-x) when others should be able to list the directory, not just traverse it — the normal public directory default. Drop to 711 only when you specifically want to hide the listing while keeping path access.
700 (rwx------) when no other user should reach inside at all, including web/service accounts. 711 is the deliberate loosening of 700 that grants traversal-only to everyone.
701 (rwx-----x) when you want only others (world) to traverse but not the group — rarer, but the same 'execute-only entry' idea applied selectively. 711 grants that traversal to both group and others.

Set it with chmod

Apply this permission to a single file:

chmod 711 filename

Or apply it recursively to a directory and everything inside it:

chmod -R 711 directory/

The same thing in symbolic form:

chmod u=rwx,g=x,o=x filename

Frequently asked questions

What does chmod 711 mean?

chmod 711 sets rwx--x--x: the owner gets full read/write/execute, while group and others get execute only. On a directory that means they can traverse into it to reach a known path but cannot list its contents.

Why is 711 common for home directories on web servers?

The web server (e.g. www-data) must enter your home to reach public_html and serve files, but it shouldn't be able to list your private home contents. 711 grants exactly that: traverse yes, browse no.

Can someone read a file inside a 711 directory?

Only if they already know the exact filename and the file itself is readable to them. 711 blocks ls enumeration, not access to a known, world-readable file. Protect contents with the file's own permissions.

What's the difference between execute on a directory and on a file?

On a directory, the execute bit means 'may traverse/enter' (independent of read, which means 'may list'). On a file it means 'may run as a program.' 711 exploits this split: directory entry without directory listing.

Other common permissions

Or build any permission with the interactive chmod calculator.

chmod 711 — what rwx--x--x means

Permission breakdown