CPanel

Easyapache-4 News!!!

EasyApache 4 was introduced in cPanel & WHM version 11.52 and has grown into a stable  product. As of version 58 EasyApache 4 is out of BETA, and is the default for any new cPanel installation.

Why EasyApache 4  I want to tell you :

  • Building with EasyApache 4 is Fast

    No need to full recompile of Apache and PHP for adding new module. With EasyApache 4 deliver Apache, PHP, and our supported PHP modules as RPMs, which means that adding a new module takes seconds.

  • Updates are  Automatic  with EasyApache 4

    Since EasyApache 4 is all RPM based, the operating system automatically takes care of updates for you

  •   PHP7 Support included in EasyApache 4

PHP7 will only be available for cPanel & WHM customers as part of EasyApache 4.             cPanel  already considering adding PHP 7.1, which just entered its third Alpha.

  • Multiple versions of PHP supported :EasyApache 4

    With cPanel & WHM version 58, We are  adding the ability to mange multiple PHP versions from WHM.

  • Easy to switch to EasyApache 4

    Switching  on easyapache4 is easy to do using our simple command-line script, and the conversion process requires no additional work from you

  • All  EasyApache RPMs are open source and available on github! Advanced users who want to customize the EasyApache 4 RPMs provided by cPanel can do so with ease!

 

So Get Set Go!!!!!

What is BCC in an eMail

 

BCC is a function used in emails and have an interesting purpose in some cases. An average email recipient has three classes, the first is the usual “To” recipient “CC” and finally the “BCC”. The first one is intended for the main recipients of the email, the second is for those recipients who are to receive a copy of the mail, and finally, the BCC who will receive a copy of the email but their email will not be seen by the other recipients. The usefulness of the BCC is to allow a long list of people interested in receiving the email, but for some reason they want to remain hidden.

The “To” field is for sending mail to people who are active in a project or subject of the email. This field addresses all visible together by interest of the email. This is because it is assumed that all are related to work and therefore have to keep in touch. On the other hand, the “CC” field are people who will not directly addressed email, and can also be interesting to know their e-mail each other.

The “BCC” field may be people who are related in some way to the job or project, but it is not essential that your email addresses are known. This can be for several reasons. The most common use for the primary recipient does not know who is receiving a copy of the email. While this can be done easily by a second copy of the message body and by forwarding the BCC field allows us to do this in a simple way and in a single step.

The BCC recipient will see the main direction on who is sending the mail (the “To” field), but the main target will see it is the only one who is sending the email. In mailing lists, the BCC camp is normally used as a courtesy for individuals who are part of the list. Even if everyone agrees to share your e-mail, have a mailing list too long is a risk of spam. It is also a risk for the subject of certain viruses, which include all the email addresses to replicate. The BCC field stops get all directions.

The meaning of BCC is Blind Carbon Copy, and is a term that predates the computers we know. At other times, when letters were written, it was done alternating pages of carbon paper between normal paper where it was written. When writing a letter several copies were made. Addresses and greetings were often left blank during the carbon copy, and then added by hand later. In this way the recipient does not know who else was receiving the letter.

 

Dealing against SQL Injections

SQL Injection (SQLI) is a code injection technique. Here, the attacker adds Structured Query Language code to a web input box. SQl is the universal language of databases and the injected SQL commands, which alter SQL statements, can compromise the security of a web application. SQLI is considered as one among the major web application vulnerabilities. It is one of the common mechanisms used by hackers to steal organizational data.

Mostly technologies built in dynamic script languages are more vulnerable like ASP.NET, PHP, JSP, ASP etc. Wide knowledge on SQL queries is what is required to make SQLI possible. This simplicity of SQL injection has accelerated its popularity. The attacker gains access to databases mainly because of vulnerability in the code used and the displayed results of sent SQL queries. Attackers can also be detained by implementing high security to the database.

SQL injection types that can be executed within a web server are:

Poorly Filtered Strings, Incorrect Type Handling, Signature Evasion, Filter Bypassing, Blind SQL Injection etc.

Considering the technicalities, you are under the risk of SQL injection if you have any applications which have not been routinely updated and patched and also if your code is not properly written. Most important precautions to be taken are data sanitization and validation. In sanitization, it has to be ensured that any submitted data should be filtered for any dangerous or unwanted characters. In validation, dangerous characters are blacklisted and only the characters allowed in the circumstances are whitelisted.

Some of the steps to mitigate SQL injection attacks are:

  •  Database Precautions: Use parameterised queries; restrict the web user with access only to the particular table.
  • Regular updates and patches: Routine updates and application of security patches can help identify vulnerabilities.
  • Firewall: Install a Web Application Firewall to help filter malicious data.
  • Perform basic security measures: Change the passwords of database accounts on a regular basis.
  • Coding: Always ensure your code’s functionality. Make the code writers responsible for checking the code and fix the security flaws within.

Hope this clears you how to deal with sql  🙂

 

free memory available in your Dedicated Server !!!

The command “free“ is used to check the RAM usages in the server. First of all, let us familiarise about the output of that command. The output of the command is as follows:

free o/p

In this example, the total amount of available memory is 1048576 KB. 570264 KB is used by processes and 478312 KB is free for other applications. Do not get confused, as the first line shows that 152280 KB is free! It is clear from the example that most of the memory used is for buffers and cache.

some terms related to cache:

Page Cache:

When a process like read or write a file is executed, a copy of the file is being modified in the main memory at the back end. Actually this scenario is performed by the kernel of the OS. So when the read or write process is executed, the kernel first looks for the copy of the file. And if no such copy exists it will create that copy of the file from the disk and writes back changes, whenever the modification is performed. So the memory taken up by these copies is called cached memory or page cache.

Clean Cache Page and Dirty Cache Page:

In this case, the kernel allocates one new page of cache memory and fills it with contents to be read out from the disk. When the user only reads the file the page will be marked as a ‘Clean’ cache page and when the user writes the file then that page will be marked as ‘Dirty’ cache page.

The memory issues in the Linux servers can be overcome by controlling the usage of page cache from the total memory in the server. Controlling of the page cache is done by changing the page cache kernel parameters. The lower the percentage, the more the system favors reclaiming unmapped page cache memory over mapped memory. High values (like the default value of 100) are not recommended for databases.

how we can limit the Page Cache or Cache Memory size.

Page cache phenomenon can consume as much memory as available in the machine for executing a process. It could be controlled only dynamically. And there is no particular kernel parameter to directly control page cache size. We could only limit the growth of page cache by tuning some configurable kernel parameters related to the page cache.

==> vm.vfs_cache_pressure (default = 100)

The parameter is used to control the tendency of the kernel to reclaim memory. Lowering this parameter causes the kernel to prefer and retain dentries and inodes caches and increasing this parameter beyond 100 causes the kernel to prefer to reclaim dentries and inodes.

==> vm.dirty_background_ratio ( default = 20)

The parameter is used to indicate the percentage of a system memory. Lowering this parameter will cause the pdflush to write away the dirty data sooner, and it will limit the size of the page cache.

==> vm.dirty_ratio (default=40)

The parameter is used to determine the percentage of the number of pages at which a particular process writes out the data for making the Dirty Cache page (Dirty data). Lowering this parameter will cause that particular process to write the Dirty data earlier, which will limit the page cache size.

==> vm.dirty_expire_centisecs ( default = 3000 , mentioned in milliseconds)

The parameter is used to determine the expiration time for the Dirty pages created so that they could equip themselves to be flushed out by the pdfush. Lowering the value will make more dirty pages to be eligible for flushing out, which would limit the page cache size.

==> vm.swappiness ( default=60)

The parameter is used to determine how soon you want to swap out the data during a process. The Higher parameter will cause the server more likely to swap and the lower parameter will cause the server less likely to swap. Thus, it will write data faster out of the disk and it will limit the Page cache size.

To change parameters dynamically on a running machine

Use the following command.

echo “500” > proc/sys/vm/vfs_cache_pressure

If you want persistent configuration make the modification to /etc/sysctl.conf.

sysctl -w vm.vfs_cache_pressure=”500″.

Stay tune to learn more on cache memory 🙂

Hardening WordPress Security

WordPress is the most popular blogging and CMS system on the Internet which makes it a favorite target for hackers. Having a WordPress site means that you have to take some extra efforts in order to protect your and your visitors data hence hardening your WordPress deployment is mandatory.

We know from experience that having your site hacked is not fun. That’s why, here at WebHostingWorld, we take security very seriously.
In line with our serious approach to security, our products are carefully optimized to be as secure as possible. There are, however, still a handful of potential security risks, when running a website, that we have no control over. You, the website owner, need to pay attention to these potential security risks, in order to keep your website safe.

With that in mind, here are few things you can do to improve your WordPress security.

1. Update all the things

It is really important to keep your core WordPress files and all of your plugins, themes updated to their latest versions. Every new release of WordPress contains patches and fixes that address real or potential vulnerabilities. If you don’t keep your website updated with the latest version of WordPress, you could be leaving yourself open to attacks.

Many hackers will intentionally target older versions of WordPress with known security issues, so keep an eye on your Dashboard notification area and don’t ignore those ‘Please update now’ messages.

update

Don’t ignore this!

The latest version of WordPress is always available on official WordPress site. Official release is not available from other websites or resources, thus, NEVER update WordPress from third party resources. Also, you can easily update WordPress from Admin Dashboard directly

updatingwp

WordPress update

It is strongly recommended to update your plugins and themes to the latest versions too, as a bug in one of these can affect your whole installation. You can update both plugins and themes via Admin Dashboard > choose Plugins or Themes menu and click ‘Update now’ near the necessary plugin or theme:

updatingplugins

plugins update

updatingthemes

themes update

NOTE: it is recommended to create backups of your WordPress files and database before applying any changes.

2. Strengthen up those passwords

You will be surprised to know that there are thousands of people that use phrases like “password” or “123456” for their admin login details. Needles to say, such passwords can be easily guessed and they are on the top of the list of any dictionary attack.

The goal with your password is to make it hard for other people to guess and hard for a brute force attack to succeed. Many automatic password generators are available that can be used to create secure passwords.

https://identitysafe.norton.com/password-generator/

Things to avoid when choosing a password:

  • Any permutation of your own real name, username, company name, or name of your website.
  • A word from a dictionary, in any language.
  • A short password.
  • Any numeric-only or alphabetic-only password (a mixture of both is best)

3. Don’t use the “admin” username

The default WordPress login is ‘admin’ and most hackers know that. It should be changed to custom one with a strong password which include upper/lower keys, numbers and symbols. If you’re installing a new WordPress site, you will be asked for username during the WordPress installation process.

installing WordPress

installing WordPress


If you have already installed WordPress you can still change username.The easiest way to change your WordPress username is by creating a new user with your desired username and with the administrator user role. You will need to use a different email address than the one used by the old account.

  • To add a new user on your WordPress site, simply click on Users » Add New and fill out the form.

add-new-user-wordpress

  • Add a new user with Administrator role, make sure you use a strong password.
  • Now you need to logout and then login with the new user account you just created.
  • Go to the Users section and click on the Delete link under your old username

    delete-user-wp

    add user

While deleting your old user, WordPress will ask what you want to do with their content. Make sure that you click on ‘Attribute all content to:’ option and then select the new user you just created. Click on the ‘Confirm Deletion’ button to delete the old user account.

attribute-content-newuser

delete user

That’s all you have successfully changed your WordPress username

4. Protect your WordPress Admin Area

Keeping “wp-admin” folder protected adds an extra layer of protection. Whoever attempts to access files or directory after “wp-admin” will be prompt to login.

Protecting your “wp-admin” folder with login and password can be done in several ways:

4.1. WordPress plugin

Using the WordPress AskApache Password Protect plugin.

4.2. cPanel

You can set protection easily on any folder via cPanel’s Password Protect Directories

  •  Go to cPanel > Security > Password Protect Directories to access a list of your site’s folders:
Password Protect Directories

Password Protect Directories

  • Choose the directory you wish to protect and click on it
Password Protect Directories

Password Protect Directories

Put a tick on Password protect this directory and name your protected directory, insert the username and password and click on Add or Modify the Authorized User button to save your changes:

4.3. .htaccess + htpasswd

Creating a password-protected folder can also be done easily by setting the folders you want to protect inside .htaccess and users allowed to access inside .htpasswd.

The best you can do is to get our home IP address (you can use a site like whatismyip.com for that) and add these lines to the .htaccess file in your WordPress admin folder replacing xx.xxx.xxx.xxx with your IP address.

<Files wp-login.php>
order deny,allow
Deny from all
Allow from xx.xxx.xxx.xxx
</Files>
In case you want to allow access to multiple computers (like your office, home PC, laptop, etc.), simply add another Allow from xx.xxx.xxx.xxx statement on a new line.

5. Securing wp-config.php

It is very important to protect wp-config.php file and wp-admin folder since they are more susceptible for hacker attack.

Move wp-config.php outside of the web directory (eg. one directory up). WordPress knows to look for the file in other directories if it can’t find it in the web directory.

The trouble is, if a hacker managed to gain access to your admin panel, they could also edit your files that way, and execute whatever code they wanted to.

So it’s a good idea to disable this method of file editing, by adding the following to your wp-config.php file. You can put this in that file (at the very top) to deny access to anyone surfing for it:

<files wp-config.php>
order allow,deny
deny from all
</files>

The WordPress Dashboard by default allows administrators to edit PHP files, such as plugin and theme files. This is often the first tool an attacker will use if able to login, since it allows code execution. WordPress has a constant to disable editing from Dashboard. Placing this line in wp-config.php is equivalent to removing the ‘edit_themes’, ‘edit_plugins’ and ‘edit_files’ capabilities of all users:

define(‘DISALLOW_FILE_EDIT’,true);

6.Changing database prefix

Your website might be at stake if you are using the predictable wp_ prefixes in your database.

This one can be difficult to do but it is the absolute most critical.  By default, WordPress prefixes all its database tables “wp_”.  Changing the table prefix to a random string makes it difficult if not impossible for a hacker to execute remote SQL injection attacks.

If you haven’t installed WordPress yet, then during installation you can change the table prefix to the random string you generated previously.  Make sure you add an underscore ( _ )  after the string so your tables are easier to read.

changing table prefix

changing table prefix

If you have already installed WordPress you can still change database prefix in two ways: either manually or using a special plugin.

  • For manual database prefix change, go to cPanel > phpMyAdmin menu > choose the necessary database from the left side > click on SQL option above.

Here you need to run RENAME SQL queries on tables in your WordPress database:

RENAME table `wp_commentmeta` TO `newprefix_commentmeta`;
RENAME table `wp_comments` TO `newprefix_comments`;
RENAME table `wp_links` TO `newprefix_links`;
RENAME table `wp_options` TO `newprefix_options`;
RENAME table `wp_postmeta` TO `newprefix_postmeta`;
RENAME table `wp_posts` TO `newprefix_posts`;
RENAME table `wp_terms` TO `newprefix_terms`;
RENAME table `wp_term_relationships` TO `newprefix_term_relationships`;
RENAME table `wp_term_taxonomy` TO `newprefix_term_taxonomy`;
RENAME table `wp_usermeta` TO `newprefix_usermeta`;
RENAME table `wp_users` TO `newprefix_users`;

*where newprefix_ should be replaced with new database prefix you wish to have instead of wp_, then click Go:

changing table prefix1

sql query

  • Once done, you will see the new database prefix has been applied to your WordPress database:
table_prefix

table prefix

  • After that you will need to search the options table for any other fields that is using wp_ as a prefix in order to replace them. It is necessary to run the following query in the same way:
SELECT * FROM `newprefix_options` WHERE `option_name` LIKE ‘%wp_%’
options table

options table

  • Then click Go and you will get the result as on the screenshot below:
table prefix

table prefix

  • Here you will need to go one by one to change these lines and replace the old database prefix with the new one. Once done, we need to search the usermeta for all fields that is using wp_ as a prefix with the help of this SQL query:

SELECT * FROM `newprefix_usermeta` WHERE `meta_key` LIKE ‘%wp_%’
sql query

sql query

  • After that click Go and the following results will appear:
changing database prefix

changing database prefix

Number of entries may vary on how many plugins you are using and such. Here you need to change everything that has wp_ to the new prefix as well.

  • Once done, make sure to update your wp-config.php file with new database prefix:
changing database prefix in wp-config.php

changing database prefix in wp-config.php

Also, you can change database prefix using special plugins, like Change DB prefix or Change table prefix.

7. Plugins For Better Security

7.1. WP DB Backup

WP DB Backup is an easy to use plugin which lets you backup your core WordPress database tables just by a few clicks. Besides it is so easy, it
has also been one of the most used plugin to secure your WP-powered website.

7.2. WP Security Scan

With this plugin, scanning your WordPress-powered site will be a simple task. It finds the vulnerabilities in your site and offer useful tips on removing them.

7.3. User Locker

If you want to avoid brute-force hacking your site, then the User Locker plugin is right for you. It works on the same system as Login
Lockdown, however, it’s a 5-stars rated WP plugin which has a great fame among its users. With this plugin, scanning your WordPress-powered site will be a simple task. It finds the vulnerabilities in your site and offer useful tips on
removing them.

8. Keeping the backups

Back up your data regularly, including your MySQL databases. A sound backup strategy could include keeping a set of regularly-timed snapshots of your entire WordPress installation (including WordPress core files and your database) in a trusted location.

The following is a very simple version of how to use phpMyAdmin to back up your WordPress database.

  • 1. Click on Databases in your phpMyAdmin panel. (It may not be necessary to do this, depending on your version of phpMyAdmin)
database backup

database backup

  • You may have several databases. Click the one that holds your WordPress data, the database you created when you installed WordPress.
  • Below is a picture of the default tables in the Structure view tab. You may have more tables — this would happen if you have any statistics plugins or anti-spam plugins.
database structure

database structure

  • Click Export. There are two methods to export, Quick and Custom; if you choose Custom, follow these steps:

1.1. Select all the tables.
1.2. In the Output section check Save output to a file and select None for Compression. (If your database is very large use a compression method)
1.3. Select SQL from the Format drop-down menu.
1.4. Check “Add DROP TABLE”: this can be useful for over-writing an existing database.
1.5. Check “IF NOT EXISTS”: this prevents errors during restores if the tables are already there.
1.6. Click Go. The data will now be saved into your computer.

Keep these files safe, copied and stored in separate places on separate media.

The tips provided above do not guarantee 100% secure of your WordPress website, however, they drastically decrease chances of getting hacked. We sincerely hope this article helped you enough in securing your online business and becoming a trouble-free and happy customer.