# WordPress Root Permission Fix

**Date:** 2026-06-19
**Root cause:** Claude was SSHing as root instead of using MCP/CyberPanel tools. All files he touched — plugins, themes, uploads, entire WordPress cores — were created as `root:root`.

## Scope

**6,022** root:root files found across **23** WordPress sites on kaburusvr.

### Worst-affected sites

| Site | Root files | Notes |
|------|-----------|-------|
| pilates-edinburgh.co.uk | 1,128 | 727 in wp-includes/, 17 in wp-admin/, 386 in wp-content/ |
| womenunlimited.africa | 1,107 | 727 in wp-includes/, 17 in wp-admin/, 365 in wp-content/ |
| kaburu.co | 746 | 727 in wp-includes/, 17 in wp-admin/, 4 in wp-content/ |
| l8.kaburu.co.uk | 747 | 727 in wp-includes/, 17 in wp-admin/, 9 in wp-content/ |
| myretonmarquees.co.uk | 756 | 727 in wp-includes/, 17 in wp-admin/, 14 in wp-content/ |

Sites with 727+ files in wp-includes/wp-admin had entire WordPress cores rsynced as root.

## Fix

Applied to all 23 sites:

```bash
# Per-site fix
find /home/{site}/public_html \
  -not -path "*/wp-content/cache/*" \
  -not -path "*/wp-content/upgrade/*" \
  -user root -o -group root \
  -exec chown {user}:{user} {} \;
```

**Result:** 0 remaining root:root files on all sites.

## Prevention

- Never SSH as root to edit WordPress files
- Use CyberPanel file manager, WP-CLI, or MainWP for changes
- If a file must be created from CLI, use `sudo -u {siteuser}` first
- Run monthly check: `find /home/*/public_html -user root -not -path '*/cache/*' | wc -l`
- **2026-08-08 scan**: 11 files fixed across 7 sites (WooCommerce logs, Matomo cache, Divi backup); zero remaining across 33 sites

## Domain → User mapping

| Domain | User |
|--------|------|
| 24hrresponse.com | hrres2834 |
| aberdeenrda.co.uk | aberd5761 |
| bankhousecatering.co.uk | bankh8998 |
| billing.myretonmarquees.co.uk | billi5214 |
| chippy.kaburu.co.uk | chipp4625 |
| claybusters.scot | clayb2704 |
| dm-ph.com | dmphc8782 |
| doctorfin.co.uk | docto8981 |
| friendscic.org | frien4362 |
| ggsgenerators.co.uk | ggsge3754 |
| jafricasafari.com | jafri6941 |
| kaburu.co | kabur9976 |
| kaburu.co.uk | kabur1825 |
| kaburusvr.uk | kabur1351 |
| l8.kaburu.co.uk | lkabu6077 |
| l8waterhygiene.co.uk | lwate2101 |
| longniddrybowlingclub.com | longn1310 |
| longniddrybowlingclub.co.uk | longn9376 |
| myretonmarquees.co.uk | myret1790 |
| pilates-edinburgh.co.uk | pilat8918 |
| rf.kaburu.co | rfkab7804 |
| touchwell.co.uk | touch6410 |
| womenunlimited.africa | women7624 |

## 2026-08-22 — Second regression: 23 sites ×596 root files (Gwen)

**Trigger:** Daily permcheck cron flagged 23 sites with ~596 root-owned files each (~13,720 total).

**Investigation:** Original fix had a shell-syntax bug — used `-user root -o -group root` without parentheses, so it matched files with **either** root user **or** root group, then chowned only the matched files. The `wp-includes/` core rsync from 2026-06-19 had files owned by root:root which matched correctly, but plugin/theme updates after the fix were sometimes creating files as root:www-data (group = root's group) which the buggy `find` then failed to chown.

**Fix:** Created `/home/kaburu/wiki/scripts/permfix-once.sh` — uses `\( -user root -o -group root \)` (proper grouping), auto-detects site owner from `stat -c %U /home/<domain>/public_html`, excludes `wp-content/cache/*` and `wp-content/upgrade/*`. 23/23 sites → 0 root-owned files. Verified 4 sites can write to their own `public_html/` (touch+remove smoke test).

**Sites fixed:** 24hrresponse.com, aberdeenrda.co.uk, bankhousecatering.co.uk, billing.myretonmarquees.co.uk, chippy.kaburu.co.uk, claybusters.scot, dm-ph.com, doctorfin.co.uk, friendscic.org, ggsgenerators.co.uk, jafricasafari.com, kaburu.co, kaburu.co.uk, l8waterhygiene.co.uk, longniddrybowlingclub.com, longniddrybowlingclub.co.uk, myretonmarquees.co.uk, pilates-edinburgh.co.uk, rainbowflavours.co.uk, rainbowvapes.co.uk, thechippyvan.co.uk, touchwell.co.uk, womenunlimited.africa.