chmod 711: others can pass through, but not look around

What chmod 711 means

In 711 the first digit is the owner, the second the group and the third everyone else: the owner gets read, write and execute, the group gets execute only, and others get execute only.

ls -l shows -rwx--x--x. Each 1 is the execute bit alone. On a directory, read and execute are separate rights: read lets you list the names, execute lets you traverse the directory and open an entry by name. 711 hands out the second without the first.

Home directories

711 is a common compromise for home directories on shared hosts. Other users cannot run ls on your home and see what is there, yet a web server can still reach ~/public_html when that subdirectory is itself readable, and a shared file can be opened if someone gives out its full path and the file's own mode allows it. Some hosting control panels and distributions use exactly this mode for that reason.

Compared with 755, it hides file names. Compared with 700 and 750, it still allows traversal, which is what makes per-user web directories and similar setups work.

Hiding is not protecting

711 relies on names being hard to guess. Well-known paths such as .bashrc, .ssh or .config are trivial to guess, so every file and subdirectory below needs its own sensible mode: 700 on ~/.ssh, 600 on secrets, and so on. If nothing inside needs to be reachable by other accounts, 700 is simpler and stricter. Root, as always, is not limited by any of these bits.

On a file

On a compiled binary, 711 lets everyone run it while only the owner can read its bytes. On a script it does much less: an interpreter has to read the file to run it, so a user without read permission gets "Permission denied" from the shell. Use 755 for scripts others should run.