Introduction

WordPress cleanup work often fixes one problem and creates another when file ownership or permissions change in the process. The site may stop updating plugins, serving assets, or writing uploads because the web server and PHP process no longer have the access they need.

Symptoms

  • Plugin updates or media uploads fail after malware cleanup or migration
  • Pages return 403, missing assets, or permission-related PHP warnings
  • File manager shows root-owned or inconsistent ownership across site files
  • The site partially works but write operations fail
  • Security hardening changes were made quickly during incident response

Common Causes

  • Cleanup scripts or manual commands changed ownership to the wrong system user
  • Permissions were tightened too far and blocked normal reads or writes
  • Restores merged files from different systems with inconsistent modes
  • The uploads directory or cache paths are no longer writable
  • Teams granted overly broad permissions, then another tool reset them unevenly

Step-by-Step Fix

  1. Identify which operations fail now, such as uploads, plugin updates, cache writes, or serving static files.
  2. Compare current ownership and permissions across the WordPress root, wp-content, uploads, and plugin directories.
  3. Restore the expected service ownership so the web server and PHP process can read and write only the paths they should control.
  4. Correct directory and file modes to a sane baseline rather than making everything globally writable.
  5. Check .htaccess, security tools, and SELinux or other access controls if standard permissions alone do not explain the denial.
  6. Re-test uploads, updates, and front-end page delivery after each ownership or mode correction.
  7. Remove any emergency permission broadening that was added during cleanup once the proper access model is restored.
  8. Review the cleanup or deployment workflow that caused the permission drift so it does not happen again.
  9. Keep a documented permission baseline for WordPress so future incident response stays controlled and reversible.