WordPress Core Upgrade File Ownership for Web Server User

Answer to the Core Questions

1. What file owner and group should WordPress core directories use for unattended upgrades?

• Owner: the user that the web‑server process runs as (e.g., www‑data on Debian/Ubuntu, apache on CentOS).
• Group: the primary group of that user or a group that includes the web‑server user. The group does not need write permission unless the hosting environment requires it.

2. Is group write access required in addition to web server user ownership?

• Not required for WordPress core upgrades. The web‑server user must have write permission on the directories it needs to replace (wp‑admin, wp‑includes, root). Group write is only necessary if other processes or users need to modify those files.

3. Does deleting .maintenance before confirming complete file replacement expose a partially upgraded site?

• Yes. Removing .maintenance prematurely can make the site visible while some files are still being replaced, leading to inconsistent behavior or errors.

Likely Explanation (Environment‑Dependent)

WordPress upgrades rely on the file‑system permissions of the web‑server user. The core does not perform an atomic replace, so a failed upgrade can leave a mix of old and new files. The .maintenance file is a signal that the upgrade is in progress; it should remain until the process finishes and all files are verified.

Confirmed Facts

• WordPress core documentation states that the web‑server user must be able to write to the core directories.
• There is no explicit requirement for group write access in the core code.
• Removing .maintenance before the upgrade finishes can expose a partially upgraded site.

Steps for Your Site

1. Identify the web‑server user:

   ps aux | grep -E 'apache|httpd|nginx'
   # Example output shows the user (e.g., www-data)
   

2. Check current ownership of core directories:

   ls -ld wp-admin wp-includes wp-content
   # Verify that the owner matches the web‑server user
   

3. If ownership is incorrect, change it (run as root or using sudo):

   sudo chown -R www-data:www-data /path/to/wordpress
   # Replace www-data with your web‑server user and group
   

4. Confirm that the web‑server user has write permission on the directories:

   sudo -u www-data touch /path/to/wordpress/wp-admin/.testwrite
   # If the file is created, write permission is present
   rm /path/to/wordpress/wp-admin/.testwrite
   

5. During an upgrade, keep the .maintenance file in place until the process reports completion. Only delete it manually if you are certain all files have been replaced and verified.

6. After the upgrade, run a quick check:

   wp core check-update --format=json
   # Verify that the reported version matches the installed files
   

One Missing Diagnostic Detail

To tailor the ownership recommendation precisely, could you confirm the name of the user that your web server runs as on this host?