# WordPress Sites — Hetzner CyberPanel

17 WordPress sites hosted on the Hetzner CyberPanel server (49.13.202.144).
Each site has its own Linux system user (CyberPanel convention).
All sites now on FastPixel cache.

**⚠️ CRITICAL: Never use WP-CLI as root on Hetzner.** It creates files owned by root, which PHP-FPM (running as the site user) cannot write to. This breaks plugin updates, uploads, cache, and language files. Use MainWP MCP tools first (`mainwp_sites`, `mainwp_updates_available`). If MainWP can't handle it, tell Steve to use the MainWP dashboard — MainWP Child runs inside WordPress as the correct user. Flaude (previous AI) left 11,525 root-owned files across 27 sites this way, fixed 2026-07-03.

**💡 Code changes across sites → MainWP Code Snippets extension, not MU plugins.** Snippets are centrally managed, individually toggleable per site, and easy to roll back. MU plugins require SSH/root and leave no dashboard visibility.

| Domain | System User | Cache | Notes |
|--------|-------------|-------|-------|
| 24hrresponse.com | hrres2834 | FastPixel | |
| aberdeenrda.co.uk | aberd5761 | FastPixel | Migrated May 2026 |
| bankhousecatering.co.uk | bankh8998 | FastPixel | |
| billing.myretonmarquees.co.uk | billi5214 | FastPixel | Subdomain of myreton |
| claybusters.scot | clayb2704 | FastPixel | Migrated May 2026; DiviCommerce theme (known PHP warnings — non-critical) |
| dm-ph.com | dmphc8782 | FastPixel | |
| doctorfin.co.uk | docto8981 | FastPixel | Migrated May 2026 |
| friendscic.org | frien4362 | FastPixel | |
| ggsgenerators.co.uk | ggsge3754 | FastPixel | |
| jafricasafari.com | jafri6941 | FastPixel | DiviCommerce theme; has themify-wc-product-filter plugin — check compatibility before major updates |
| kaburu.co | kabur9976 | FastPixel | |
| kaburusvr.uk | kabur1351 | FastPixel | MainWP dashboard, wiki, Matomo |
| l8waterhygiene.co.uk | lwate2101 | FastPixel | |
| myretonmarquees.co.uk | myret1790 | FastPixel | |
| pilates-edinburgh.co.uk | pilat8918 | FastPixel | Migrated May 2026 |
| touchwell.co.uk | touch6410 | FastPixel | Behind Cloudflare; Wordfence IP source = HTTP_CF_CONNECTING_IP |
| womenunlimited.africa | women7624 | FastPixel | WooCommerce; Peach Payments active |
| rainbowvapes.co.uk | rainb1286 | FastPixel | Migrated from guru 2026-08-18; WooCommerce, Worldpay, Avanti child theme |

## Security — Applied to All Sites (2026-05-18/19)

- `license.txt`, `wp-config-sample.php`, `readme*.html`, `error_log` deleted from all webroots
- `xmlrpc.php` blocked via LiteSpeed vhost context (all 30 sites, 2026-08-13) — the old `.htaccess` block was dead code on LiteSpeed
- `.user.ini` chmod 640 on all sites (contains Wordfence WAF auto_prepend_file)
- mu-plugin `remove-sensitive-files.php` installed on all sites — auto-removes sensitive
  files after WP core updates

## Off-Hetzner Sites (managed via MainWP)

| Domain | Host | Notes |
|--------|------|-------|
| longniddrybowlingclub.com | Namecheap | Migration to Hetzner planned — see [[longniddrybowlingclub]] |