Server security

Updates, credentials and 2FA, one PHP-FPM pool per site, login limits, off-site backups and monitoring: the hardening checklist to follow after a cleanup.

WP-CLI checksums, sha256 manifests, inotify and AIDE: how to spot a modified or newly appeared file on your site right away, without drowning in false alarms.

How to recognize a server that is sending spam, find the PHP script responsible, flush Postfix and Exim queues, and recover your domain’s reputation.

Same system user, shared PHP pools, forgotten staging copies: why one infected site contaminates the others on the account, and how to truly isolate them.

Injected auto_prepend_file, AddHandler and rewrite rules: how .htaccess and .user.ini load backdoors before WordPress, and how to find, verify and remove them.

User crontabs, /etc/cron.d and WP-Cron events: where the persistence that reinfects a WordPress site after cleanup hides, and how to inspect it.

After a cleanup: check wp-config.php, regenerate keys and salts, use the security constants, and set file permissions and ownership correctly.

Why webshells end up in wp-content/uploads, how to find them and how to block PHP execution on Apache, LiteSpeed and NGINX, and what the block does not cover.