Security

How to Protect Your Website from Hacking Basic website security rules for WordPress and other CMS platforms on ZevsHost hosting. DDoS Protection at ZevsHost: How It Works How L3/L4/L7 DDoS protection works on ZevsHost servers and what to do during an attack. Strong Passwords and Password Managers Rules for creating strong passwords for hosting accounts and password manager recommendations. SSL Certificate Types: DV, OV, EV — What's the Difference How DV, OV, and EV SSL certificates differ: verification level, cost, browser display, and which sites each type suits. Comparison table. HTTPS Mixed Content: How to Find and Fix It What mixed content is on an HTTPS site, why the browser blocks resources, and how to fix mixed content errors in WordPress, code, and via .htaccess. Protecting Your Website from Spam and Bots Methods for protecting website forms and comments from spam: reCAPTCHA, honeypot, anti-spam plugins. ModSecurity WAF: protecting web applications on Apache/Nginx What ModSecurity WAF is, how to install and configure it on Apache and Nginx, enable OWASP CRS rules, manage false positives, and monitor attacks. Fail2ban: Protecting SSH and Nginx from Password Guessing Installing and configuring Fail2ban on Ubuntu/Debian. Protect SSH, your web server, and control panel from automated password-guessing attacks. Content Security Policy (CSP): protection from XSS How to configure Content Security Policy against XSS: default-src, script-src, style-src, report-uri directives. CSP examples for WordPress and SPA apps. SSH Keys: Secure Passwordless Login to VPS Generating SSH keys, adding a public key to the server, disabling password login. Setup for Windows PuTTY and Linux/Mac. Cloudflare: Free CDN and DDoS Protection Connecting Cloudflare to your domain: changing NS servers, cache setup, DDoS protection, SSL, and site acceleration on the free plan. Two-Factor Authentication in cPanel: setting up 2FA How to enable two-factor authentication (2FA) in cPanel with Google Authenticator or Authy. Guide covering the QR code, backup codes, and account recovery. MySQL Security on a VPS: Protecting Against Intrusion How to secure a MySQL server on a VPS: disabling remote root, mysql_secure_installation, separate database users, encrypted connections, query monitoring. UFW Firewall on a VPS: Configuring the Ubuntu Firewall How to set up UFW (Uncomplicated Firewall) on an Ubuntu VPS: basic rules, opening SSH/HTTP/HTTPS ports, blocking IPs, DDoS protection, and event logging. HSTS: forcing HTTPS to secure your site What HSTS is, how to add the header via .htaccess or Nginx, enable preload, configure max-age, and avoid errors when rolling back to HTTP. WireGuard VPN on a VPS: Quick Setup and Configuration How to install WireGuard VPN on an Ubuntu VPS in 10 minutes: key generation, server and client setup, adding peers, a QR code for your phone, and autostart. SSH Hardening: Secure Server Configuration Against Break-ins Hardening SSH security on Linux: change the port, disable root login, configure AllowUsers, MaxAuthTries, keys, and two-factor authentication. Hardening Nginx: Secure Web Server Configuration Secure Nginx configuration: hide the version, security headers, restrict HTTP methods, rate limiting, protection against clickjacking and MIME sniffing. Server-Side WordPress Hardening: Nginx and Permissions Complete WordPress protection: file permissions, xmlrpc.php, Wordfence, wp-config.php, two-factor authentication, and file change monitoring. Linux File Permissions: chmod, chown, SUID and ACL Linux file permissions: numeric and symbolic chmod notation, changing ownership with chown, special bits SUID/SGID/Sticky, extended ACLs. Secure PHP Configuration: php.ini Settings for Production Secure PHP configuration for production: display_errors, expose_php, open_basedir, disable_functions, session protection, and resource limits. Brute Force Protection: fail2ban, CAPTCHA, and Rate Limiting Comprehensive brute force protection: configuring fail2ban for SSH and the web, CAPTCHA on forms, Nginx rate limiting, geoblocking, and IP whitelisting. CrowdSec: a modern IPS defense system for VPS CrowdSec is a next-generation open-source IPS: installation on Linux, collection setup, Nginx integration, and threat blocking via shared threat intelligence. Detecting Rootkits on Linux: rkhunter and chkrootkit How to find rootkits on a Linux server: installing and configuring rkhunter and chkrootkit, automatic scheduled scanning, and reading the reports. Hacked Website: Diagnosis, Cleanup, and Recovery What to do if your website is hacked: signs of a hack, finding malicious code, cleaning up malware, restoring from backup, and preventing reinfection. New Linux Server Security Checklist: 30 Steps A complete security checklist for a new VPS/VDS: updates, SSH, firewall, fail2ban, users, monitoring — 30 steps from a bare server to a hardened host. Linux Security Auditing with auditd: Server Event Monitoring Configuring auditd for Linux security monitoring: tracking logins, file changes, privileged commands, and log analysis via ausearch. Secure MariaDB and MySQL Setup on a VPS Hardening MariaDB/MySQL: mysql_secure_installation, creating users with minimal privileges, encrypting connections, disabling remote root, and backups. Two-Factor Authentication for SSH and Web Panels Setting up two-factor authentication (2FA) on a Linux server: TOTP via Google Authenticator for SSH, ISPmanager, and WordPress, with recovery instructions. DDoS attack protection: Nginx and Cloudflare Comprehensive DDoS protection: connection limits in Nginx, rate limiting, configuring Cloudflare DDoS Protection, sysctl tuning, and responding to an attack. Let's Encrypt Wildcard: Auto-Renewal for Subdomains How to get a Wildcard SSL certificate from Let's Encrypt via DNS verification, set up Certbot auto-renewal, and verify it with acme.sh and the Cloudflare API. iptables: setting up a Linux firewall from scratch iptables: core INPUT/OUTPUT/FORWARD chains, allowing SSH/HTTP/HTTPS, blocking ports, scan protection, saving rules. Mandatory Access Control: Configuring SELinux and AppArmor Mandatory access control in Linux: how to configure SELinux on RHEL, AppArmor on Ubuntu, check the working mode, and avoid breaking a site during migration. GPG Encryption for Server Files and Backup Archives GPG encryption for files and backups protects server data if a disk is stolen, an archive leaks from S3 storage, or traffic is intercepted in transit. LUKS Disk Encryption: Securing a Server Drive and Keys LUKS disk encryption protects server data if the drive is physically removed: luksFormat, crypttab, keyfile, Clevis+Tang and header backup covered in practice. Wazuh SIEM: Server Security Monitoring and FIM Control Wazuh SIEM for server security monitoring combines log analysis, file integrity monitoring (FIM), and automatic attack blocking through active response rules. osquery: Server Inventory and Breach Traces Osquery turns a Linux server into a SQL database: how to install it, query processes and ports, and find breach traces after an incident. Storing Secrets on a Server: HashiCorp Vault and Env Vars Storing secrets on a server: how to set up HashiCorp Vault, issue temporary passwords for MySQL, and protect environment variables instead of an .env file. Dependency Audit: npm audit and composer audit Dependency audit on a server: how to run npm audit and composer audit, read a vulnerability report, and update packages without breaking a site. SSH Certificates: Login via a Certificate Authority SSH certificates replace distributing public keys: users get short-lived certificates from a certificate authority instead of long-term SSH keys. Port Knocking and SPA for Hidden SSH Access Port knocking and Single Packet Authorization hide the SSH port from scanners: access opens only after a secret sequence of packets. Incident Response Plan: The First 60 Minutes An incident response plan covers the first 60 minutes of an attack: isolating the server, collecting evidence, assessing damage, and notifying staff. How a DDoS Attack Works and Why a Site Goes Down An explanation of DDoS attack mechanics: how it differs from a hack, which resources get overloaded, and how to tell an attack from a visitor surge. How to Check an SSL Certificate: Methods and Commands How to check an SSL certificate in a browser, with the openssl command, and a service: expiration, chain, renewal, and common errors. SSL Pinning: What It Is and How It Works in Apps SSL pinning in simple terms: why it is used, what gets pinned, the main danger at certificate renewal, and when it makes sense. Is SSH TCP or UDP, and why it works that way Why SSH uses TCP instead of UDP, how to check port 22 on a server, and whether UDP needs opening in the firewall. FTPS and SFTP: Why They Are Different Protocols How FTPS differs from SFTP: protocols, ports, and rules for choosing between them for file transfer to a server. Why a Domain Needs an SSL Certificate and How to Add One Why a domain needs an SSL certificate, what it protects technically, and how to connect one to a site correctly. Vaultwarden on a VDS: your own password manager server How to deploy Vaultwarden in Docker on a VDS: TLS via a reverse proxy, an admin token, limiting sign-ups, and database backups. GDPR for a hosted website: what it requires in practice Controller and processor roles, the data processing agreement, breach notification deadlines, and user rights under the GDPR — an overview, not legal advice. Mailcow: your own mail server in Docker containers What the Mailcow stack consists of, how much memory it needs, how to run it in Docker, and which DNS records stay mandatory for deliverability. PHP2Shell (CVE-2026-109618/109619): How to Check and Fix Two critical PHP vulnerabilities rated CVSS 9.2 allow unauthenticated code execution. How to check your server in a minute and how to fix it. PHP2Shell: What to Do If You Cannot Update Right Now Temporary mitigations for CVE-2026-109618 and CVE-2026-109619: php.ini settings, nginx limits, and WAF rules. What they do and what they do not. Auditing PHP and nginx Versions Across a Server Fleet How to collect PHP and nginx versions from all your servers in one pass, find the vulnerable ones, and avoid mistaking a backport for a real vulnerability. Updated After PHP2Shell: Signs You Were Compromised The vulnerability was exploited before the patch was released. What to look for in logs and files, which keys to rotate, and in what order to act. cPanel and WHM login bypass CVE-2026-41940: what to do A critical cPanel and WHM vulnerability rated 9.8 allows login without a password. Exploited since February 2026. How to check your build and update. Nextcloud and Collabora CVE-2026-110447: update or remove A vulnerability in the built-in CODE server allows command execution without login. Disabling the app does not help. How to update and find leftover web shells. ClamAV and Maldet: Finding Malware on a Linux Server How to find web shells and malware on a Linux server with ClamAV, clamscan, freshclam and Linux Malware Detect. Quarantine, reports and signature limits. Docker Bypasses UFW: How to Firewall Container Ports Why a container port is open to the internet even with UFW enabled, and how to fix it: 127.0.0.1 binding, the DOCKER-USER chain and isolated Docker networks. Trivy: Scanning Docker Images for Vulnerabilities How to scan a Docker image for known vulnerabilities with Trivy: installation, severity levels, ignore list, build integration and rebuilding the base image. Website Vulnerability Scan: nuclei, nikto, wpscan How to check your own website for vulnerabilities with nuclei, nikto and wpscan: what scanners show, how to read a report and how a scan differs from a pentest. Browser SSL errors: causes and how to fix them The browser says the certificate is not trusted or has expired. Five causes of SSL errors, how to identify each with openssl and how to fix it. Basic Auth: password for a site section in Nginx, Apache How to password-protect a site section or login page: htpasswd, auth_basic in Nginx, .htaccess in Apache. Pros, cons and protection against password guessing. Linux certificate store: adding your own root CA Where the trusted certificate store lives in Ubuntu and RHEL, how to add your own root certificate and why Java, Python and Node do not see it. Automatic security updates in Linux How to enable automatic security updates: unattended-upgrades on Ubuntu and Debian, dnf-automatic on RHEL, service restarts and logs. Linux user passwords: passwd and chage How to change a password in Linux and Ubuntu: passwd, chage, shadow files, root and sudo passwords, complexity rules via pam_pwquality. Open server ports: how to check and close them How to find out which server ports are reachable from the internet: ss -tulpn, external checks, typical findings and ways to close them. TLS certificates: lifetimes are being cut to 47 days From 15 March 2026 the maximum certificate lifetime is 200 days, 100 from 2027 and 47 from 2029. What changes on your server and how to prepare. Post-quantum TLS and SSH: what to enable on a server X25519MLKEM768 in TLS and mlkem768x25519-sha256 in SSH: which OpenSSL, nginx and OpenSSH versions you need, how to enable hybrid key exchange and verify it. SSH key on a FIDO2 token: ed25519-sk and ecdsa-sk How to create an SSH key on a FIDO2 hardware token with ssh-keygen, how resident keys differ, how to set touch and PIN on the server, and keep your access.