Guides from the NOC

Confused by red and yellow warnings in WHM's Security Advisor? Here's what each common one really means, which to fix today, and which are safe to skip.

Wordfence, Sucuri, or iThemes blocking your own login? Regain access via File Manager or SFTP, fix the firewall rule, and whitelist your IP for good.

Install Elasticsearch on a VPS the right way: fix the vm.max_map_count bootstrap error, size the JVM heap correctly, and lock down access before going live.

Learn what WordPress AUTH_KEY and salt constants do, why mass logouts happen after migration, and how to safely rotate them via cPanel or WP-CLI.

Missing security headers flagged in a scan? Learn how to add CSP, HSTS, X-Frame-Options, and more via .htaccess in cPanel without breaking your site.

Learn how to configure unattended-upgrades on your Ubuntu/Debian VPS to auto-install security patches without breaking services or triggering surprise reboots.

A form or upload throwing 403 for no reason? Learn how to find the exact ModSecurity rule ID blocking it and whitelist it safely in cPanel or WHM.

Lock down your WordPress site: strong auth, login limits, file permissions, disabled editors, and backups. A practical hardening checklist that actually helps.

Two critical PHP bugs, fixed on 21 October 2026 and already under attack. Updating WordPress won't help - PHP itself has to be updated. How to check yours.

The connection opened and then something slammed it shut. A reset is deliberate, which makes this one of the more findable errors once you know where to look.

Nothing answered at all. Silence means a packet was dropped rather than rejected, and that narrows the search to the firewall layers between you and the port.

Cut spam and brute-force logins by blocking traffic from specific countries using CSF's CC_DENY on a VPS or Cloudflare firewall rules - step by step.

Subdomain takeover happens when a dangling CNAME points to a deleted third-party resource. Learn how to scan your DNS zone, fix it, and prevent it for good.

Sucuri's WAF blocking real visitors, admins, or webhooks on your WordPress site? Learn why the false positives happen and how to whitelist safely.

Fix Windows VPS RDP connection errors and stop brute-force login attempts with port changes, NLA, firewall rules, and strict account lockout policies.

Learn how to run cPanel's built-in Virus Scanner, read its results, and safely remove or quarantine infected files without SSH or root access.

Softaculous install stuck or failing in cPanel? Here's every real cause - disk quota, database limits, PHP version, mod_security - and how to fix each one.

Locked out of your VPS with SSH "Permission denied (publickey)"? Every real cause - wrong key, bad permissions, SELinux, sshd_config - and the fix for each.

Learn how to configure Nginx limit_req to stop bot floods and brute-force attacks on your VPS, with real config examples, testing steps, and common mistakes.

Learn which wp-config.php changes are safe—memory limit, debug mode, forced SSL, file editing—and the syntax mistakes that cause a WordPress white screen.

Grant cPanel MySQL database users only the privileges they actually need. Read-only, backup, and app-specific access explained with GRANT/REVOKE examples.

Still running CentOS 7 or 8 past its end-of-life date? Here's how to safely migrate your VPS to AlmaLinux or Rocky Linux without losing data or uptime.

Learn how to set up passwordless passkey login for WordPress admin using WebAuthn, avoid lockouts, and fix common setup errors on cPanel hosting.

Add TOTP two-factor authentication to SSH logins on your VPS using PAM and Google Authenticator, including the fix for the lockout risk everyone hits first.