ملاحظات من طابور المناوبة

حوادث حقيقية من خوادم cPanel فعلية. الأنماط التي نراها متكررة.

11 مايو 2026قراءة 15 دقيقةoperations infrastructure
86 CPU spikes in 24 hours: a multi-cause cascade postmortem
A cPanel server fired 86 ChkServd CPU alerts in one day. Four root causes were amplifying each other. The triage, the order of fixes, and the lessons.
#cpanel #chkservd #cpu #performance #incident-response #postmortem
10 مايو 2026قراءة 8 دقيقةwordpress security operations
Hardening every WordPress site on cPanel in one loop
A field-tested bash loop that walks every cPanel user, finds every WordPress install, and applies an idempotent hardening checklist with weekly drift detection.
#wordpress #cpanel #hardening #bash #security
9 مايو 2026قراءة 6 دقيقةoperations infrastructure wordpress
When you have to suspend a WooCommerce client: anatomy
A WooCommerce client burned 40-60% CPU on a shared cPanel box for 48 hours, unreachable. The decision tree, the suspension, and the conversation after.
#cpanel #woocommerce #shared-hosting #incident-response #runbook
8 مايو 2026قراءة 14 دقيقةoperations wordpress infrastructure
Patchman activation breaks PHP sites: memory_limit gotcha
Patchman daily scans on cPanel push large WordPress sites past the PHP memory_limit and trigger 500s. Diagnostic flow, two-part fix, pre-activation audit.
#patchman #cpanel #php #memory-limit #wordpress #multiphp
7 مايو 2026قراءة 8 دقيقةwordpress operations infrastructure
The corrupted WordPress db.php dropin nobody warned you of
WordPress says the DB connection is down but MySQL is fine, and only one site is affected. The cause is almost always a broken db.php dropin in wp-content.
#wordpress #mysql #cpanel #incident-response #dropins
6 مايو 2026قراءة 14 دقيقةoperations security infrastructure
Locked out of cPanel SSH: VNC, iptables, and the way back in
How to recover from a cPanel SSH lockout using your provider's VNC console, iptables flush, and CSF restore, plus the audit that prevents the next one.
#cpanel #csf #ssh #iptables #vnc #lockout
5 مايو 2026قراءة 6 دقيقةinfrastructure operations
When the client changes DNS without telling you first
Mail dies, AutoSSL stops renewing, the homepage shows a registrar parking page. A short field guide to diagnosing and fixing a silent DNS handover.
#dns #cpanel #autossl #registrar #incident-response
4 مايو 2026قراءة 13 دقيقةmail infrastructure
AutoSSL fails on Microsoft 365 autodiscover subdomains: the fix
Why cPanel AutoSSL emails nightly that autodiscover.client failed HTTP-01 when the client uses Microsoft 365, and the two-step WHM exclusion fix.
#autossl #cpanel #microsoft-365 #ssl #dns #http-01
3 مايو 2026قراءة 12 دقيقةinfrastructure operations
cPanel disk full at 96 percent: the backup retention trap
A postmortem on a cPanel /home at 96 percent, why 7 backup sets ate 331GB, the safe-deletion order, and the WHM retention that stops the cascade.
#cpanel #whm #disk-full #backups #chkservd #mysql
2 مايو 2026قراءة 14 دقيقةwordpress security infrastructure
xmlrpc.php abuse and the 27-site one-shot fix on cPanel
A postmortem on 5,400 xmlrpc.php requests an hour from one /24, why per-site plugin fixes fail, and the shell loop that hardened 27 WordPress sites at once.
#xmlrpc #wordpress #cpanel #php-fpm #csf #htaccess
30 أبريل 2026قراءة 16 دقيقةwordpress security
Three real WordPress compromises and how we found them
Three anonymised WordPress compromise postmortems on cPanel: a nulled Elementor Pro backdoor, a wp_options casino injection, and a six-week data exfiltration.
#wordpress #malware #cpanel #incident-response #wp-cli #forensics
29 أبريل 2026قراءة 13 دقيقةsecurity infrastructure
SSH brute force on cPanel: the 8,127-attempt night and the fix
A postmortem on 8,127 failed SSH logins to a cPanel server in six hours from rotating /24s, why lfd alone could not see the pattern, and the layered fix.
#ssh #csf #lfd #cpanel #brute-force #fail2ban
27 أبريل 2026قراءة 12 دقيقةdatabase operations
MySQL OOM on cPanel: diagnosing innodb_buffer_pool_size
A 2026 postmortem on MySQL OOM on cPanel: ChkServd alerts, the InnoDB buffer pool error, the math behind safe sizing, and the fix flow we ship.
#mysql #mariadb #innodb #cpanel #oom-killer #chkservd
25 أبريل 2026قراءة 15 دقيقةwordpress infrastructure security
WooCommerce filter URLs are a crawler trap: the fix
A 2026 postmortem on WooCommerce filter URLs as a crawler trap: 41,000 unique URLs/hour from Facebook and MJ12bot, the diagnostic, and a three-layer fix.
#woocommerce #facebook-crawler #mj12bot #cpanel #mod-security #faceted-navigation
23 أبريل 2026قراءة 2 دقيقةdatabase operations
Sample incident: MariaDB OOM kill on a shared cPanel node
A walkthrough of one Saturday-morning MySQL crash on a cPanel server: what alerted, what we ran, and the InnoDB buffer-pool change that closed the ticket.
#mysql #mariadb #oom #innodb #cpanel
22 أبريل 2026قراءة 17 دقيقةwordpress infrastructure
WordPress WP-Cron stacking on cPanel: a complete fix
A 2026 postmortem on WordPress WP-Cron stacking on cPanel: 41 concurrent PHP-FPM children, the HTTP loopback that doubles load, and the three-layer fix.
#wp-cron #wordpress #php-fpm #cpanel #ea-php
20 أبريل 2026قراءة 14 دقيقةsecurity infrastructure
CSF, lfd, and Imunify360: why your firewall is killing itself
A 2026 postmortem on cPanel servers running CSF and Imunify360 in parallel: lfd OOM kills, csf.deny bloat, iptables races, and the fix we ship.
#csf #lfd #imunify360 #cpanel #iptables #firewall
19 أبريل 2026قراءة 2 دقيقةsecurity infrastructure
Imunify360 custom SSH port: stop blocking your admins
Tell Imunify360 about your non-22 SSH port so its brute-force protection stops blocking legitimate admin connections, with a verification command.
#imunify360 #ssh #cpanel #firewall
17 أبريل 2026قراءة 2 دقيقةwordpress operations
Disable WP-Cron across every WordPress site on cPanel
An idempotent bash script that disables WP-Cron across every WordPress install on a cPanel server and replaces it with staggered system cron entries.
#wordpress #wp-cron #cpanel #bash
16 أبريل 2026قراءة 2 دقيقةsecurity operations
Find SSH attacker subnets in /var/log/secure: a quickref
One-liner to surface the top attacking /24 subnets in /var/log/secure during an SSH brute-force wave, plus per-username and per-minute variations.
#ssh #brute-force #grep #log-analysis
15 أبريل 2026قراءة 2 دقيقةdatabase operations
MariaDB slow log permissions on cPanel: the quick reference
Fix MariaDB slow_log Permission denied on cPanel after a MariaDB updater run, plus a weekly cron that re-asserts ownership before the next reset.
#mariadb #mysql #cpanel #slow-log
13 أبريل 2026قراءة 3 دقيقةoperations infrastructure
ChkServd alert field guide: reading cPanel service alerts
Decode the chkservd alert subject lines and bodies cPanel sends when a service flaps, with notes on common false positives and how to tune sensitivity.
#cpanel #chkservd #monitoring #alerting
12 أبريل 2026قراءة 1 دقيقةoperations
Welcome to the sguard.ai blog
Notes from the on-call queue: how we triage, diagnose, and fix the cPanel incidents that hit shared hosting nodes. Written for the operators.
#announcement #intro