# WordPress Root Permission Fix
Date: 2026-06-19 Root cause: Claude was SSHing as root instead of using MCP/CyberPanel tools. All files he touched — plugins, themes, uploads, entire WordPress cores — were created as `root:root`.
## Scope
6,022 root:root files found across 23 WordPress sites on kaburusvr.
### Worst-affected sites
| Site | Root files | Notes |
| —— | ———– | ——- |
| pilates-edinburgh.co.uk | 1,128 | 727 in wp-includes/, 17 in wp-admin/, 386 in wp-content/ |
| womenunlimited.africa | 1,107 | 727 in wp-includes/, 17 in wp-admin/, 365 in wp-content/ |
| kaburu.co | 746 | 727 in wp-includes/, 17 in wp-admin/, 4 in wp-content/ |
| l8.kaburu.co.uk | 747 | 727 in wp-includes/, 17 in wp-admin/, 9 in wp-content/ |
| myretonmarquees.co.uk | 756 | 727 in wp-includes/, 17 in wp-admin/, 14 in wp-content/ |
Sites with 727+ files in wp-includes/wp-admin had entire WordPress cores rsynced as root.
## Fix
Applied to all 23 sites:
```bash # Per-site fix find /home/{site}/public_html \
```
Result: 0 remaining root:root files on all sites.
## Prevention
- Never SSH as root to edit WordPress files - Use CyberPanel file manager, WP-CLI, or MainWP for changes - If a file must be created from CLI, use `sudo -u {siteuser}` first - Run monthly check: `find /home/*/public_html -user root -not -path '*/cache/*' | wc -l` - 2026-08-08 scan: 11 files fixed across 7 sites (WooCommerce logs, Matomo cache, Divi backup); zero remaining across 33 sites
## Domain → User mapping
| Domain | User |
| ——– | —— |
| 24hrresponse.com | hrres2834 |
| aberdeenrda.co.uk | aberd5761 |
| bankhousecatering.co.uk | bankh8998 |
| billing.myretonmarquees.co.uk | billi5214 |
| chippy.kaburu.co.uk | chipp4625 |
| claybusters.scot | clayb2704 |
| dm-ph.com | dmphc8782 |
| doctorfin.co.uk | docto8981 |
| friendscic.org | frien4362 |
| ggsgenerators.co.uk | ggsge3754 |
| jafricasafari.com | jafri6941 |
| kaburu.co | kabur9976 |
| kaburu.co.uk | kabur1825 |
| kaburusvr.uk | kabur1351 |
| l8.kaburu.co.uk | lkabu6077 |
| l8waterhygiene.co.uk | lwate2101 |
| longniddrybowlingclub.com | longn1310 |
| longniddrybowlingclub.co.uk | longn9376 |
| myretonmarquees.co.uk | myret1790 |
| pilates-edinburgh.co.uk | pilat8918 |
| rf.kaburu.co | rfkab7804 |
| touchwell.co.uk | touch6410 |
| womenunlimited.africa | women7624 |
## 2026-08-22 — Second regression: 23 sites ×596 root files (Gwen)
Trigger: Daily permcheck cron flagged 23 sites with ~596 root-owned files each (~13,720 total).
Investigation: Original fix had a shell-syntax bug — used `-user root -o -group root` without parentheses, so it matched files with either root user or root group, then chowned only the matched files. The `wp-includes/` core rsync from 2026-06-19 had files owned by root:root which matched correctly, but plugin/theme updates after the fix were sometimes creating files as root:www-data (group = root's group) which the buggy `find` then failed to chown.
Fix: Created `/home/kaburu/wiki/scripts/permfix-once.sh` — uses `\( -user root -o -group root \)` (proper grouping), auto-detects site owner from `stat -c %U /home/<domain>/public_html`, excludes `wp-content/cache/*` and `wp-content/upgrade/*`. 23/23 sites → 0 root-owned files. Verified 4 sites can write to their own `public_html/` (touch+remove smoke test).
Sites fixed: 24hrresponse.com, aberdeenrda.co.uk, bankhousecatering.co.uk, billing.myretonmarquees.co.uk, chippy.kaburu.co.uk, claybusters.scot, dm-ph.com, doctorfin.co.uk, friendscic.org, ggsgenerators.co.uk, jafricasafari.com, kaburu.co, kaburu.co.uk, l8waterhygiene.co.uk, longniddrybowlingclub.com, longniddrybowlingclub.co.uk, myretonmarquees.co.uk, pilates-edinburgh.co.uk, rainbowflavours.co.uk, rainbowvapes.co.uk, thechippyvan.co.uk, touchwell.co.uk, womenunlimited.africa.