Website Admin & Server Security Commands

DNS not resolving? SSL certificate expiring? Email bouncing back? Before you open a support ticket, run these commands. This toolkit covers every common webmaster diagnostic — from propagation checks across four DNS resolvers to DKIM/DMARC validation to database backup one-liners. If something's wrong with your site, start here.

• A/MX/TXT/NS lookup + propagation check across 4 DNS resolvers
• SSL certificate expiry + full redirect chain + TLS version audit
• WordPress core checksum verification + unauthorized admin audit
• SPF, DKIM, DMARC record validation and mail deliverability check
• MySQL backup one-liner + DB size + autoloaded data bloat check

AV fired an alert. The machine is slow and your IT person isn't sure. Before rebuilding from scratch, run this one PowerShell script — it auto-detects Windows 7, 10, or 11 and runs 12–13 forensic checks in about 60 seconds. Red output means investigate; green means clear. No extra tools, no install, just paste and run as Administrator.

• Outbound reverse shell connections (netstat + process correlation)
• WMI event subscription backdoors (common RAT persistence technique)
• Windows Defender exclusion list tampering
• Registry Run key enumeration across HKLM and HKCU
• Recently created/modified executables in suspicious paths

Your server is actively compromised. Here's what matters: volatile evidence — running processes, open connections, deleted-but-executing files — disappears the moment someone reboots. Run the process and network commands first, before anything else. This toolkit follows the correct triage order: capture what's alive, then find persistence, then analyze logs. Don't skip steps and don't kill processes until you've documented them.

• Process forensics with full command lines, parent PIDs, and binary paths
• Deleted-but-running files via lsof — a classic attacker anti-forensic technique
• SSH authorized_keys backdoor detection across every user account
• Cron, systemd timer, PAM, and ld.so.preload persistence enumeration
• Memory dump, rootkit scan (rkhunter/chkrootkit), Java memshell detection

Suspicious process in Task Manager. Unknown outbound connection in netstat. Event ID 1102 — the audit log was cleared. These are the signals that something is wrong. This toolkit gives you a PowerShell-only investigation playbook: no Sysinternals, no extra downloads, just admin rights. Run it on any Windows machine without installing anything.

• Full process command lines with parent IDs — what ps doesn't show you
• WMI event subscription enumeration (hidden backdoors most scanners miss)
• Scheduled task content extraction — reads the actual script, not just the name
• Event IDs 4624/4625/4688/4720/1102/7045 — the IR-critical event set
• LSASS access patterns and credential theft indicators

A containerized service spawned a shell process. Your K8s cluster shows API calls you didn't make. MySQL has a user account you didn't create. Modern infrastructure attacks don't look like traditional server compromises — they target privileged containers, RBAC misconfigurations, and database extension backdoors. This toolkit covers forensics for the full cloud-native stack.

• Docker container escape detection — privileged flags, dangerous volume mounts
• K8s RBAC over-privilege audit, secret enumeration, and rogue pod detection
• MySQL UDF backdoor detection + binary log replay to reconstruct attacker actions
• File integrity verification via rpm -Va + forensic timeline reconstruction
• Oracle audit log analysis and Redis unauthorized access checks

PHP backdoors hide in upload directories, disguised as image files. JSP webshells sit dormant for weeks before activating. Behinder and Godzilla agents leave almost no disk footprint. If your site was defaced or is making unexpected outbound calls, the backdoor is probably already there — you just haven't found it yet. These grep patterns and nuclei templates will.

• PHP/JSP webshell grep patterns targeting eval, base64, assert, and exec
• Behinder / Godzilla C2 agent signatures and traffic patterns
• nuclei vulnerability scanning templates for rapid CVE detection
• Shiro-550/721, Log4Shell, Spring4Shell, Fastjson CVE-specific checks
• FOFA reconnaissance syntax for finding your own exposed services

Redis on 0.0.0.0:6379. SSH with password authentication. Nginx returning server version in headers. These misconfigurations appear in nearly every post-breach report. This toolkit is the "fix it before someone finds it" checklist — the exact commands to lock down Nginx, SSH, iptables, fail2ban, and the Linux kernel before a red team or automated scanner gets there first.

• Nginx security headers + automated scanner IP blocking with fail2ban
• SSH key-only authentication + authorized algorithm enforcement
• iptables default-deny + precise whitelist pattern
• fail2ban custom jail for WordPress login brute-force protection
• sysctl kernel hardening parameters + auditd syscall audit rules

WP-CLI turns 30 minutes of clicking around wp-admin into a single terminal command. Locked out of your admin panel? One command creates a new admin account. Migrating to a new domain? One command does the database search-replace — correctly handling serialized data that raw SQL replace would corrupt. This toolkit covers every common WordPress task you'd otherwise do through the browser.

• Mass update core, all plugins, and all themes in three lines
• Database export/import/optimize + search-replace for domain migrations
• Admin user creation, password reset, and unauthorized user deletion
• Cache flush for WP Rocket, W3TC, Redis, and LiteSpeed Cache
• File permission repair + core file integrity verification after a hack

Lighthouse score 60. SSL Labs grade B. PageSpeed says "serve static assets with an efficient cache policy." These snippets fix each of those — without touching a single line of application code. Paste a gzip block, reload Nginx, watch the score go up. Each snippet is commented with exactly where to place it and what the before/after result looks like.

• Gzip compression config + browser cache headers (1-year for static assets)
• TLS 1.3 hardened SSL — Mozilla Intermediate profile, OCSP stapling enabled
• WordPress permalink support rules + xmlrpc.php block + upload PHP execution block
• Security headers: HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy
• Login rate limiting + HTTPS/www canonicalization redirect patterns

Still uploading files via FTP? Still SSHing in to run git pull by hand? There's a better workflow: set up a bare repo on your server, push from your local machine, and a post-receive hook automatically deploys to your web root — with zero downtime, via a symlink swap that takes under a second and keeps the previous release ready for instant rollback.

• Bare repo setup on server + post-receive hook for push-to-deploy
• Zero-downtime symlink swap pattern — new release goes live atomically
• One-command rollback to the previous release (no git operations needed)
• WordPress .gitignore template — excludes credentials, uploads, and core files
• GitHub Actions deploy YAML + rsync deploy + PM2 for Node.js apps

You keep hearing "just Dockerize it" — but docker run, docker build, and docker-compose are just the beginning. Whether you're running a local dev environment, deploying a Node.js app to a VPS, or managing multi-container stacks in production, this toolkit takes you from your first container to production-hardened deployments with health checks, resource limits, and security hardening.

• Beginner: run, exec, logs, pull, build — the commands you use every day
• Intermediate: volumes, networks, Dockerfile best practices, multi-stage builds
• Docker Compose: web + DB setup, dev/prod overrides, scaling services
• Registry: push to Docker Hub, GHCR, and self-hosted private registry
• Production: health checks, memory/CPU limits, logging drivers, security hardening

Not another "write great content" guide. Every tactic here is specific, actionable, and measurable — exact title tag formulas, copy-paste schema markup, real link building email templates, a monthly GSC audit routine, and Core Web Vitals fixes with exact Nginx configs. Read it once, use it forever.

• Technical SEO: robots.txt, canonical tags, crawl budget, sitemap setup
• On-page: title formula, meta description, H-tag hierarchy, featured snippets
• Schema markup: Article, FAQ, HowTo, BreadcrumbList — copy-paste JSON-LD
• Link building: guest post pitch template, HARO template, broken link workflow
• Google Search Console: monthly routine, position 4-15 wins, cannibalization fix

You bought a domain and a VPS — now what? This roadmap walks you from a blank server to a live, indexed, optimized WordPress site with backlinks and security monitoring in place. 28 steps across 8 phases, with recommended tools at every stage. Check off as you go.

• Phase 1–3: Server → Domain → Nginx → WordPress → SSL → Google/Bing Search Console
• Phase 4: WordPress plugins — backup, SEO, caching, speed testing
• Phase 5: SEO research — keyword tools, competitor analysis, long-tail mining
• Phase 6: Backlink building — free platforms, guest post outreach, authority tracking
• Phase 7–8: Security scans, AI content check, uptime monitoring, rank tracking

You get root access to a Linux server and the terminal stares back at you. Whether you're a developer who just got a VPS, a blogger setting up Nginx, or someone trying to figure out why the server is slow at 2am — this toolkit covers everything from basic navigation to performance tuning. Start at the top, work your way down, copy and paste as you go.

• Beginner: navigation, files, grep, pipes, permissions, user management
• Intermediate: processes, networking, disk usage, package management (apt + dnf)
• SSH & remote: passwordless login, config file shortcuts, tunnels, port forwarding
• systemd services + cron scheduling — run anything on a schedule or at boot
• Bash scripting essentials + performance: CPU, RAM, disk I/O, strace debugging

Not sure where to start when your site is compromised? Answer 3–4 diagnostic questions — is the site down, showing malware, flagged by Google, locked out? — and this tool routes you directly to the right commands and toolkit. No more reading docs top-to-bottom trying to figure out which applies to you.

• Site down: server offline, Nginx down, disk full, DB crash, PHP-FPM failure
• Malware: WP spam injection, defacement, webshell cleanup, credential rotation
• Google blocking: Safe Browsing removal, search result warning, deindexed recovery
• WP lockout: password reset, deleted admin, plugin conflict, IP block
• DDoS: network flood, bot blocking, rate limiting, Cloudflare setup

One bash script, run every Sunday, 30 seconds, catches problems before they become emergencies. Disk full? SSL expiring? Backup missing? Brute force attack? Suspicious process running? Webshell dropped? The script checks all of it and prints PASS / WARN / FAIL for each item.

• Disk, RAM, CPU load — with color-coded thresholds you set
• SSL certificate expiry check — warns you at 30 days, fails at 7
• Backup file age check — fails if no backup in the last 7 days
• Failed SSH login count — detects brute force attacks
• Suspicious processes + recently modified PHP files — malware early warning