Clean a Hacked WordPress Site on cPanel: Step-by-Step
Clean a hacked WordPress site on a cPanel server: isolate, scan with Imunify360 or ClamAV, verify checksums, find backdoors and rogue admins, rotate secrets and harden.
October 6, 2026
WordPress CVE-2026-64638 Patch: Find and Update Every Vulnerable Site
WordPress CVE-2026-64638 (XSS2Shell): what is affected, which versions fix it per branch, and how hosts find and update every vulnerable site.
October 6, 2026
WordPress Version Audit: Find Every WordPress Site and Its Version
Free bash script that finds every WordPress install on cPanel, DirectAdmin or plain servers and flags core versions below 7.0.3 (CVE-2026-64638).
October 6, 2026
Imunify360 False Positives: Find the Rule ID and Fix It
Fix Imunify360 false positives: identify the layer, find the rule ID, disable a ModSecurity rule per domain, handle the 2026 WordPress WAF and report it.
October 6, 2026
Install OpenLiteSpeed and WordPress on AlmaLinux 10 (No Panel)
Install OpenLiteSpeed, LSPHP 8.4, MariaDB and WordPress on AlmaLinux 10 from the official LiteSpeed repository, with HTTPS and LiteSpeed Cache.
October 6, 2026
One-Click Unsubscribe (RFC 8058) for Exim, Postfix, WordPress
Add RFC 8058 one-click unsubscribe correctly: List-Unsubscribe and List-Unsubscribe-Post headers, DKIM signing in Exim and OpenDKIM, a WordPress example and a tested endpoint.
October 6, 2026
Force HTTPS for a Domain in DirectAdmin (Tested on 1.712)
Redirect every http:// address of a DirectAdmin domain to https:// with Force SSL, from the panel or the API, and check it with a redirect test. Tested on DirectAdmin 1.712.
October 6, 2026
Access Log Top IPs and Bots Report
An access log top IPs report for Apache, LiteSpeed and Nginx: top IPs, agents, URLs, fake Googlebots, 404/5xx and wp-login or xmlrpc floods for the last minutes or hours, across all vhosts.
September 30, 2026
Redirect Chain Checker
A redirect chain checker for the command line: follows each URL hop by hop with curl and flags loops, chains longer than two, 302s, HTTPS downgrades, non-200 endings and inconsistent www/https variants.
September 30, 2026
PHP-FPM Slow Log Analyzer
Turns a PHP-FPM slow log into answers: slow requests grouped by script, stack frame, function and WordPress plugin, plus pm.max_children hits and timeouts per pool next to each pool's settings.
September 30, 2026
WP Toolkit CVE-2026-87900: what is affected and how to patch to 6.11.3
WP Toolkit CVE-2026-87900 is a critical argument-injection flaw in WP Toolkit for cPanel 6.11.2-10794 and earlier. Which versions are affected, how to confirm the fix, and what to check afterwards.
September 30, 2026
WordPress cURL Error 28: Failed to Connect Fixed (Imunify360 and CSF)
Diagnose the WordPress cURL error 28 loopback and outbound failure on cPanel servers, identify whether Imunify360, CSF, /etc/hosts or the resolver is blocking the connection, and apply the whitelist or rule fix with verification.
September 29, 2026