27 October 2026
"My MySQL is safe, it's bound to localhost" Check before you believe it. Default MySQL on some images binds 0.0.0.0, and a stray GRANT ... TO 'root'@'%' from a tutorial leaves the door open. Verify, don't assume: — ss -t…
@RootAccessDaily
18 October 2026
Server hardening is not optional for self-managed VPS — it's what separates operators who run affiliate properties for years from those who get compromised in months. Minimum security baseline for every new VPS: 1. Disab…
@RootAccessDaily
11 October 2026
"Force HTTPS with a PHP/.htaccess redirect" If you're doing the http→https redirect in PHP or app middleware, every plain-http hit boots a full FPM worker just to send a 301. Bots hammer http://; you're burning workers o…
@RootAccessDaily
07 October 2026
"Throw Redis at it to speed things up" On a 2GB box, Redis is another daemon fighting MySQL for RAM. If your cache hit data is small and read-heavy, OPcache + a filesystem cache often beats it with zero memory pressure. …
@RootAccessDaily
04 October 2026
"PermitRootLogin no and SSH is hardened" That's step one of ten. Attackers don't need root to ruin you — a cracked deploy user with sudo and a password is game over. Real hardening stack: — PermitRootLogin no — PasswordA…
@RootAccessDaily
30 September 2026
Nginx vs Apache is not a performance debate anymore. It's a configuration management debate. For sites with predictable traffic patterns and static content, the performance difference is negligible on modern hardware. Wh…
@RootAccessDaily
29 September 2026
"Max out keepalive_timeout for performance" High keepalive (like 75s) holds a worker slot open per idle client. On a low-connection box behind a CDN, that's slots wasted on browsers doing nothing. If Cloudflare/a CDN fro…
@RootAccessDaily
28 September 2026
"ufw allow 443 and I'm firewalled" ufw only controls the INPUT chain. If you run Docker, it punches iptables rules straight into the DOCKER chain and bypasses ufw completely — your "closed" port 5432 is wide open to the …
@RootAccessDaily
27 September 2026
"Site's slow, upgrade to more RAM" Usually wrong. Run free -h — if it shows free RAM and low swap, RAM isn't your problem and the $10/mo upgrade does nothing. Check the real culprits first: — iostat -x 1 for disk wait (%…
@RootAccessDaily
26 September 2026
"Run the cron every minute to stay fresh" Classic Laravel mistake: * * * * * firing a heavy job that takes 70 seconds. Now two overlap, then three, and your $5 box load hits 8. Guard it: — flock -n /tmp/job.lock command …
@RootAccessDaily
25 September 2026
"Crank gzip to level 9 for max compression" On-the-fly level 9 burns CPU for ~2% smaller files vs level 5. On a 1-vCPU box that CPU is your whole budget. Use gzip_comp_level 5; for dynamic responses. For static assets, d…
@RootAccessDaily
24 September 2026
"NVMe is fast, I don't need swap" Speed isn't why you keep swap. Without it, a memory spike that overshoots by 50MB triggers the OOM killer to assassinate a random process — usually your DB, mid-write. A small swapfile i…
@RootAccessDaily
23 September 2026
"Set vm.swappiness=0 on every server" Bad advice that gets parroted everywhere. swappiness=0 doesn't disable swap — since kernel 3.5+ it means "only swap to avoid OOM," which can trigger the OOM killer to nuke your MySQL…
@RootAccessDaily
22 September 2026
"Changing SSH port is security theater" The purists love saying this. They're wrong about what it's for. It's not encryption — it's noise reduction. Moving off 22 drops automated scan attempts ~95%. That matters: clean a…
@RootAccessDaily
21 September 2026
"Set innodb_buffer_pool_size to 80% of RAM" That rule is for dedicated DB servers. On a $5 LEMP box where PHP-FPM, nginx AND MySQL share 2GB, 80% means instant OOM. Reality on a shared box: size it to your actual data, n…
@RootAccessDaily
21 September 2026
Hunt the RAM hog in 3 commands Box at 95% memory and you don't know why. My triage order: — free -h first — if buff/cache is high that's FINE, Linux uses free RAM as cache, ignore it — Real offenders: ps aux --sort=-%mem…
@RootAccessDaily
20 September 2026
First 10 minutes on a fresh $4 VPS Just spun up a new box. Before I touch nginx I do this in order, every time: — adduser deploy && usermod -aG sudo deploy (kill root login next) — ssh-copy-id deploy@IP then test the log…
@RootAccessDaily
20 September 2026
"Behind Cloudflare so I don't need a firewall" Your origin IP leaks — old DNS records, mail headers, SSL cert logs (crt.sh). Once found, attackers hit your IP direct and bypass Cloudflare entirely. Lock the origin to onl…
@RootAccessDaily
19 September 2026
rsync vs restic for backups rsync mirrors files fast and you can read the result with any tool — but it's not real versioning; an oops overwrites your only copy. restic does deduplicated, encrypted, snapshot backups stra…
@RootAccessDaily
19 September 2026
"Set nginx worker_processes to your core count" Half-right and outdated. Just use worker_processes auto; — it reads cores itself. The real bottleneck nobody mentions is worker_connections. Default 768 means 1 vCPU caps a…
@RootAccessDaily
18 September 2026
nginx vs Caddy on a $5 box Just moved 3 sites off Caddy back to nginx. Caddy's auto-TLS is gorgeous for a single site you forget about. But the second you need fine-grained fastcgi_cache, micro-cache zones, or rate-limit…
@RootAccessDaily
18 September 2026
"More PHP-FPM workers = handle more traffic" Nope. Each pm.max_children eats 30-60MB. Set it to 50 on a 2GB box and you'll swap-thrash into a death spiral the second traffic spikes. Math it: (RAM - 512MB for MySQL/nginx)…
@RootAccessDaily
17 September 2026
Killed the :00 load spike by staggering cron Just did this on a $6 box running 15 sites. Every wp-cron and backup fired at the top of the hour, load avg hit 9.0 for ~90 seconds, sites timing out. Moved real crons off wp-…
@RootAccessDaily
17 September 2026
"fail2ban protects you from brute force" It logs and bans — after the attempt hits sshd. With a 3-retry / 10-min ban, a botnet rotating 5000 IPs still gets 15k guesses/hour through. fail2ban barely dents that. Real fix: …
@RootAccessDaily
16 September 2026
Make nginx actually use all your cores Got a 2-4 vCPU box but one core pegs at 100% while the others nap? Your listen directive is the bottleneck. — set worker_processes auto; — add reuseport to listen: listen 80 reusepo…
@RootAccessDaily
15 September 2026
Auto-patch security holes, nothing else You won't SSH in to run apt upgrade across 40 boxes. Automate ONLY the security channel so nothing breaks at 3am. — apt install unattended-upgrades — in 50unattended-upgrades keep …
@RootAccessDaily
15 September 2026
Auto-heal services so a crash isn't an outage php-fpm died at 4am, site was down till I woke up. Monit fixes that: — apt install monit -y — Watch a service: check process php-fpm with pidfile /run/php/php8.3-fpm.pid then…
@RootAccessDaily
14 September 2026
Hide SSH entirely with port knocking Port 22 closed to the world, opens only for you. Looks like the box has no SSH at all: — apt install knockd -y — Define a secret sequence in /etc/knockd.conf: knock 7000, 8000, 9000 i…
@RootAccessDaily
14 September 2026
Cage your runaway service before it kills the box One misbehaving worker or a memory-leaking node script will eat all your RAM and take the whole server down. Don't babysit it, cage it with systemd: — MemoryMax=300M — CP…
@RootAccessDaily
13 September 2026
LEMP stack from bare box in the right order Install order saves you debugging socket errors later: — nginx first: apt install nginx -y, confirm the default page loads — MariaDB next: apt install mariadb-server -y then my…
@RootAccessDaily
