Kaburu Wiki

This is an old revision of the document!

---

# WordPress Root Permission Fix

Date: 2026-06-19 Root cause: Claude was SSHing as root instead of using MCP/CyberPanel tools. All files he touched — plugins, themes, uploads, entire WordPress cores — were created as `root:root`.

## Scope

6,022 root:root files found across 23 WordPress sites on kaburusvr.

### Worst-affected sites

Sites with 727+ files in wp-includes/wp-admin had entire WordPress cores rsynced as root.

## Fix

Applied to all 23 sites:

```bash # Per-site fix find /home/{site}/public_html \

1. not -path “*/wp-content/cache/*” \
2. not -path “*/wp-content/upgrade/*” \
3. user root -o -group root \
4. exec chown {user}:{user} {} \;

```

Result: 0 remaining root:root files on all sites.

## Prevention

- Never SSH as root to edit WordPress files - Use CyberPanel file manager, WP-CLI, or MainWP for changes - If a file must be created from CLI, use `sudo -u {siteuser}` first - Run monthly check: `find /home/*/public_html -user root -not -path '*/cache/*' | wc -l` - 2026-08-08 scan: 11 files fixed across 7 sites (WooCommerce logs, Matomo cache, Divi backup); zero remaining across 33 sites

## Domain → User mapping