https://servernest.io/blog/ Plain-language security guides for people who run PHP websites on their own servers. en https://servernest.io/blog/laravel-horizon-own-serverhttps://servernest.io/blog/laravel-horizon-own-serverSat, 14 Nov 2026 00:00:00 GMTInstall Laravel Horizon on Ubuntu or Debian, keep it running with systemd, restart it on every deploy, and lock the dashboard. Tested, with the APP_NAME trap that stops queues. https://servernest.io/blog/nginx-fastcgi-cache-wordpresshttps://servernest.io/blog/nginx-fastcgi-cache-wordpressSat, 14 Nov 2026 00:00:00 GMTLet Nginx save finished WordPress pages and serve them without PHP. Tested setup for Ubuntu and Debian that skips logged-in users, carts and the admin, and clears on edits. https://servernest.io/blog/composer-install-fails-on-server-fixhttps://servernest.io/blog/composer-install-fails-on-server-fixFri, 13 Nov 2026 00:00:00 GMTYour lock file needs a newer PHP, an extension is missing, or the site shows "Composer detected issues in your platform"? Find the mismatch and fix it without breaking your versions. https://servernest.io/blog/fix-403-forbidden-file-not-found-nginx-phphttps://servernest.io/blog/fix-403-forbidden-file-not-found-nginx-phpFri, 13 Nov 2026 00:00:00 GMTNginx shows 403 Forbidden or a bare "File not found."? The error log names the cause: a missing index line, folder permissions, a deny rule or the wrong script path. All tested. https://servernest.io/blog/fix-laravel-500-server-error-own-serverhttps://servernest.io/blog/fix-laravel-500-server-error-own-serverFri, 13 Nov 2026 00:00:00 GMTA Laravel app shows "500 Server Error" or a blank page? Check the log, folders the web server can't write, a missing APP_KEY and cached settings. Tested on Laravel 13. https://servernest.io/blog/locked-out-of-wordpress-admin-reset-passwordhttps://servernest.io/blog/locked-out-of-wordpress-admin-reset-passwordFri, 13 Nov 2026 00:00:00 GMTForgot the password, no reset email, or a security plugin locked you out? Get back in with WP-CLI or one database command, then check for admin accounts you didn't create. https://servernest.io/blog/mariadb-mysql-wont-start-fixhttps://servernest.io/blog/mariadb-mysql-wont-start-fixFri, 13 Nov 2026 00:00:00 GMTThe database won't start after a settings change, a full disk or an update? Read the one log line that says why, then fix a typo, a full disk, folder owners or a busy port. All tested. https://servernest.io/blog/nginx-too-many-open-files-worker-connectionshttps://servernest.io/blog/nginx-too-many-open-files-worker-connectionsFri, 13 Nov 2026 00:00:00 GMTUnder load, Nginx drops visitors or returns 500 errors with "Too many open files" or "worker_connections are not enough". See which limit you hit and how to raise it safely. https://servernest.io/blog/nginx-wont-start-or-reload-fixhttps://servernest.io/blog/nginx-wont-start-or-reload-fixFri, 13 Nov 2026 00:00:00 GMT"nginx: [emerg]", "Address already in use" or "Job for nginx.service failed"? Test the config first, read the one line that names the problem, and why reload is safer than restart. https://servernest.io/blog/php-sessions-users-logged-out-ubuntu-debianhttps://servernest.io/blog/php-sessions-users-logged-out-ubuntu-debianFri, 13 Nov 2026 00:00:00 GMTOn Ubuntu and Debian, a cleanup job deletes PHP sessions after 24 minutes, whatever your code says. See why users get logged out, and why some session folders are never cleaned. https://servernest.io/blog/php-site-file-permissions-owners-ubuntu-debianhttps://servernest.io/blog/php-site-file-permissions-owners-ubuntu-debianFri, 13 Nov 2026 00:00:00 GMTWho should own your PHP site's files, which folders PHP may write to, why 755 and 644 are enough and 777 never is. Tested commands for WordPress and Laravel on Nginx. https://servernest.io/blog/redis-oom-command-not-allowed-maxmemoryhttps://servernest.io/blog/redis-oom-command-not-allowed-maxmemoryFri, 13 Nov 2026 00:00:00 GMTRedis says "OOM command not allowed", or users are logged out and cache keys vanish? Set maxmemory, pick the right eviction policy, and keep sessions and queues away from your cache. https://servernest.io/blog/restart-nginx-php-fpm-automatically-after-crashhttps://servernest.io/blog/restart-nginx-php-fpm-automatically-after-crashFri, 13 Nov 2026 00:00:00 GMTOn Ubuntu and Debian, Nginx (and PHP-FPM on Ubuntu) stays down after a crash until you restart it by hand. One small systemd setting brings it back in seconds. Tested step by step. https://servernest.io/blog/server-slow-find-which-site-php-fpmhttps://servernest.io/blog/server-slow-find-which-site-php-fpmFri, 13 Nov 2026 00:00:00 GMTYour PHP server is slow and you don't know why? Find the busy site with top, the busy pages with PHP-FPM's status page and access log, and the slow code with the slow log. https://servernest.io/blog/server-time-zone-clock-sync-php-mariadbhttps://servernest.io/blog/server-time-zone-clock-sync-php-mariadbFri, 13 Nov 2026 00:00:00 GMTSet the time zone on Ubuntu or Debian, keep the clock in sync, and make PHP, MariaDB and cron use the same time. Tested step by step, with the traps we found. https://servernest.io/blog/ssh-permission-denied-connection-refused-fixhttps://servernest.io/blog/ssh-permission-denied-connection-refused-fixFri, 13 Nov 2026 00:00:00 GMTSSH stopped letting you in? Tell the three errors apart, read the server's log line, fix key file permissions, and know about OpenSSH's new penalty block. All tested. https://servernest.io/blog/where-are-the-logs-php-server-ubuntu-debianhttps://servernest.io/blog/where-are-the-logs-php-server-ubuntu-debianFri, 13 Nov 2026 00:00:00 GMTNginx, Apache, PHP-FPM, MariaDB, SSH, cron, updates, Laravel and WordPress: where each log lives on Ubuntu and Debian, how to read it, and which guide to read next. https://servernest.io/blog/wordpress-critical-error-after-update-fixhttps://servernest.io/blog/wordpress-critical-error-after-update-fixFri, 13 Nov 2026 00:00:00 GMTAfter an update, WordPress shows "There has been a critical error" everywhere, even on the login page? Find the plugin or theme in one log line and switch it off from the server. https://servernest.io/blog/wordpress-permalinks-404-nginx-fixhttps://servernest.io/blog/wordpress-permalinks-404-nginx-fixFri, 13 Nov 2026 00:00:00 GMTThe home page works but every post and page gives "404 Not Found" from Nginx. Usually one try_files line is missing. Tested fix for normal and subfolder installs. https://servernest.io/blog/backup-php-website-test-restorehttps://servernest.io/blog/backup-php-website-test-restoreThu, 12 Nov 2026 00:00:00 GMTStep-by-step for Ubuntu and Debian: back up website files and databases every night with restic, encrypted and off the server, keep several copies, and test a restore. https://servernest.io/blog/block-env-git-backup-fileshttps://servernest.io/blog/block-env-git-backup-filesThu, 12 Nov 2026 00:00:00 GMTStep-by-step: check whether anyone can download your .env, .git folder or database backups, block them on Nginx or Apache, and what to do if they already leaked. https://servernest.io/blog/check-open-ports-ubuntu-debianhttps://servernest.io/blog/check-open-ports-ubuntu-debianThu, 12 Nov 2026 00:00:00 GMTStep-by-step: list the ports your Ubuntu or Debian server listens on, check them from outside with nmap, and close the ones a PHP website doesn't need. https://servernest.io/blog/composer-packages-safe-up-to-datehttps://servernest.io/blog/composer-packages-safe-up-to-dateThu, 12 Nov 2026 00:00:00 GMTFind Composer packages with known security holes, update them one at a time, deploy without surprises and never run Composer as root. https://servernest.io/blog/cron-job-not-running-ubuntu-debianhttps://servernest.io/blog/cron-job-not-running-ubuntu-debianThu, 12 Nov 2026 00:00:00 GMTA cron job that works when you type it but never runs on its own? Check the cron log, the short PATH, file names in /etc/cron.d, percent signs and missing newlines. All tested. https://servernest.io/blog/find-slow-database-queries-mysql-mariadbhttps://servernest.io/blog/find-slow-database-queries-mysql-mariadbThu, 12 Nov 2026 00:00:00 GMTTurn on the MySQL or MariaDB slow query log on Ubuntu or Debian, read it with mysqldumpslow, EXPLAIN the worst query, add an index and measure. https://servernest.io/blog/fix-413-upload-limit-nginx-phphttps://servernest.io/blog/fix-413-upload-limit-nginx-phpThu, 12 Nov 2026 00:00:00 GMTUploads fail or forms come back empty? Raise the three upload limits in the right place: Nginx, PHP and the PHP-FPM pool, then check which values PHP really uses. https://servernest.io/blog/fix-502-bad-gateway-nginx-php-fpmhttps://servernest.io/blog/fix-502-bad-gateway-nginx-php-fpmThu, 12 Nov 2026 00:00:00 GMTFind out why Nginx shows 502 or 504 for your PHP site: read the one log line that tells you, then fix a stopped PHP, a wrong socket, a permission error, big headers or slow pages. https://servernest.io/blog/fix-php-allowed-memory-size-exhaustedhttps://servernest.io/blog/fix-php-allowed-memory-size-exhaustedThu, 12 Nov 2026 00:00:00 GMTA 500 error or "critical error" page with "Allowed memory size of 134217728 bytes exhausted"? Find what uses the memory, then raise PHP's limit in the place that really counts. https://servernest.io/blog/fix-too-many-redirects-wordpress-cloudflarehttps://servernest.io/blog/fix-too-many-redirects-wordpress-cloudflareThu, 12 Nov 2026 00:00:00 GMTERR_TOO_MANY_REDIRECTS after turning on Cloudflare or HTTPS? Find the loop with one curl command, then fix the SSL mode, WordPress's HTTPS check or a www mismatch. https://servernest.io/blog/fix-wordpress-error-establishing-database-connectionhttps://servernest.io/blog/fix-wordpress-error-establishing-database-connectionThu, 12 Nov 2026 00:00:00 GMTWordPress can't reach its database. Find out why in a few minutes: check that MariaDB or MySQL runs, test the login from wp-config.php, and fix full connections or a crashed database. https://servernest.io/blog/harden-wordpress-ubuntu-debianhttps://servernest.io/blog/harden-wordpress-ubuntu-debianThu, 12 Nov 2026 00:00:00 GMTStep-by-step for Ubuntu and Debian: safe file owners, a locked wp-config.php, no PHP in uploads, xmlrpc.php blocked, automatic updates and checks with WP-CLI. https://servernest.io/blog/host-several-websites-one-server-nginxhttps://servernest.io/blog/host-several-websites-one-server-nginxThu, 12 Nov 2026 00:00:00 GMTStep-by-step for Ubuntu and Debian: run several PHP and static sites on one Nginx server, each with its own user, PHP pool, database, logs and certificate. https://servernest.io/blog/https-certificate-renewal-ubuntu-debianhttps://servernest.io/blog/https-certificate-renewal-ubuntu-debianThu, 12 Nov 2026 00:00:00 GMTCheck that certbot renews your Let's Encrypt certificates on Ubuntu or Debian, make Nginx or Apache load the new one, fix common renewal errors and get a warning before expiry. https://servernest.io/blog/https-lets-encrypt-nginx-apachehttps://servernest.io/blog/https-lets-encrypt-nginx-apacheThu, 12 Nov 2026 00:00:00 GMTStep-by-step: get a free Let's Encrypt certificate with certbot on Ubuntu or Debian, send all visitors to HTTPS, check that renewal works and add HSTS safely. https://servernest.io/blog/laravel-queue-workers-schedulerhttps://servernest.io/blog/laravel-queue-workers-schedulerThu, 12 Nov 2026 00:00:00 GMTStep-by-step: run the Laravel scheduler with cron or a systemd timer, keep queue workers running with systemd, restart them after a deploy and read their logs. https://servernest.io/blog/laravel-zero-downtime-deploy-release-foldershttps://servernest.io/blog/laravel-zero-downtime-deploy-release-foldersThu, 12 Nov 2026 00:00:00 GMTDeploy Laravel on Ubuntu or Debian with no downtime: build each release in its own folder, switch in one step, and roll back in seconds. A small bash script, tested. https://servernest.io/blog/lock-origin-to-cloudflare-ubuntu-debianhttps://servernest.io/blog/lock-origin-to-cloudflare-ubuntu-debianThu, 12 Nov 2026 00:00:00 GMTStep-by-step for Ubuntu and Debian: let only Cloudflare reach your web ports with UFW or Nginx, add Authenticated Origin Pulls, use Full (strict), and test from outside. https://servernest.io/blog/move-php-website-new-serverhttps://servernest.io/blog/move-php-website-new-serverThu, 12 Nov 2026 00:00:00 GMTStep-by-step for Ubuntu and Debian: lower the DNS TTL, copy files with rsync and the database with mysqldump, test before the switch, keep HTTPS and keep the old server as a way back. https://servernest.io/blog/mysql-mariadb-securityhttps://servernest.io/blog/mysql-mariadb-securityThu, 12 Nov 2026 00:00:00 GMTStep-by-step for Ubuntu and Debian: keep MySQL or MariaDB on localhost, give each site its own database user, block remote root, and test your backups. https://servernest.io/blog/nginx-rate-limiting-ubuntu-debianhttps://servernest.io/blog/nginx-rate-limiting-ubuntu-debianThu, 12 Nov 2026 00:00:00 GMTStep-by-step for Ubuntu and Debian: limit login tries on WordPress and Laravel, cap API calls and downloads per visitor, see the real address behind Cloudflare, and test with curl. https://servernest.io/blog/php-opcache-php-fpm-speedhttps://servernest.io/blog/php-opcache-php-fpm-speedThu, 12 Nov 2026 00:00:00 GMTStep-by-step for Ubuntu and Debian: check that OPcache is on, pick OPcache and PHP-FPM settings that fit your memory, find slow pages and measure before and after. https://servernest.io/blog/php-site-emails-not-spamhttps://servernest.io/blog/php-site-emails-not-spamThu, 12 Nov 2026 00:00:00 GMTWhy WordPress and Laravel emails from your own server end up in spam, and how to fix it: send through an email service, then set up SPF, DKIM and DMARC. https://servernest.io/blog/php-site-hacked-first-stepshttps://servernest.io/blog/php-site-hacked-first-stepsThu, 12 Nov 2026 00:00:00 GMTWhat to do first when your WordPress or Laravel site on Ubuntu or Debian looks hacked: keep a copy, close the site, find changed files, users and cron jobs, then clean up. https://servernest.io/blog/scan-php-site-malware-clamavhttps://servernest.io/blog/scan-php-site-malware-clamavThu, 12 Nov 2026 00:00:00 GMTInstall ClamAV, keep its virus list current, scan WordPress or Laravel folders every night and get an email only when it finds something. https://servernest.io/blog/secure-redis-ubuntu-debianhttps://servernest.io/blog/secure-redis-ubuntu-debianThu, 12 Nov 2026 00:00:00 GMTStep-by-step: keep Redis on localhost, give each site its own Redis user and password, block risky commands, and connect Laravel and WordPress. https://servernest.io/blog/security-headers-nginx-apachehttps://servernest.io/blog/security-headers-nginx-apacheThu, 12 Nov 2026 00:00:00 GMTStep-by-step: hide your Nginx, Apache and PHP version numbers and add the security headers browsers use to block common attacks, on Ubuntu or Debian. https://servernest.io/blog/sftp-access-one-website-ubuntu-debianhttps://servernest.io/blog/sftp-access-one-website-ubuntu-debianThu, 12 Nov 2026 00:00:00 GMTStep-by-step: let a client or developer upload files to one website with SFTP, locked in its folder, with no shell and no view of your other sites. https://servernest.io/blog/ssh-two-factor-authenticator-apphttps://servernest.io/blog/ssh-two-factor-authenticator-appThu, 12 Nov 2026 00:00:00 GMTStep-by-step: make SSH on Ubuntu or Debian ask for your key and a six-digit code from an app, with safe exceptions for deploy and SFTP users. https://servernest.io/blog/stop-logs-filling-disk-ubuntu-debianhttps://servernest.io/blog/stop-logs-filling-disk-ubuntu-debianThu, 12 Nov 2026 00:00:00 GMTFind what fills the disk, cap the systemd journal, rotate Laravel and Nginx logs with logrotate, free space held by deleted files and get a warning in time. https://servernest.io/blog/sudo-user-instead-of-roothttps://servernest.io/blog/sudo-user-instead-of-rootThu, 12 Nov 2026 00:00:00 GMTStep-by-step: create a normal user with sudo rights on an Ubuntu or Debian server, move your SSH key to it, and turn off root login without locking yourself out. https://servernest.io/blog/upgrade-php-version-ubuntu-debianhttps://servernest.io/blog/upgrade-php-version-ubuntu-debianThu, 12 Nov 2026 00:00:00 GMTStep-by-step: install a newer PHP next to the old one on Ubuntu or Debian, test your site, switch Nginx or Apache, and keep an easy way back. https://servernest.io/blog/upgrade-ubuntu-debian-release-php-serverhttps://servernest.io/blog/upgrade-ubuntu-debian-release-php-serverThu, 12 Nov 2026 00:00:00 GMTMove a PHP server from Ubuntu 22.04 to 24.04 or Debian 12 to 13 safely: back up first, upgrade over SSH without losing it, and fix the PHP sites that break after. https://servernest.io/blog/vps-out-of-memory-swap-oom-killerhttps://servernest.io/blog/vps-out-of-memory-swap-oom-killerThu, 12 Nov 2026 00:00:00 GMTSee what uses memory on a 1–2 GB Ubuntu or Debian server, find out if the OOM killer struck, add a swap file, size PHP-FPM and MariaDB, and protect SSH. https://servernest.io/blog/website-uptime-monitoring-own-serverhttps://servernest.io/blog/website-uptime-monitoring-own-serverThu, 12 Nov 2026 00:00:00 GMTCheck your site from outside the server: a free uptime service or a small curl script, health URLs for Laravel and WordPress, certificate warnings and pings for backups. https://servernest.io/blog/who-logged-in-sudo-history-ubuntu-debianhttps://servernest.io/blog/who-logged-in-sudo-history-ubuntu-debianThu, 12 Nov 2026 00:00:00 GMTStep-by-step for Ubuntu and Debian: see who is logged in, list past and failed SSH logins, match each login to a key, read the sudo history and get an alert on every login. https://servernest.io/blog/wordpress-real-cron-instead-of-wp-cronhttps://servernest.io/blog/wordpress-real-cron-instead-of-wp-cronThu, 12 Nov 2026 00:00:00 GMTStep-by-step for Ubuntu and Debian: turn off WP-Cron, run WordPress's scheduled tasks from cron or a systemd timer with WP-CLI, and check that posts publish on time. https://servernest.io/blog/wordpress-staging-copy-same-serverhttps://servernest.io/blog/wordpress-staging-copy-same-serverThu, 12 Nov 2026 00:00:00 GMTStep-by-step for Ubuntu and Debian with Nginx: copy a WordPress site to staging.example.com with its own user and database, keep it private, and block its emails. https://servernest.io/blog/automatic-security-updates-ubuntu-debianhttps://servernest.io/blog/automatic-security-updates-ubuntu-debianWed, 11 Nov 2026 00:00:00 GMTStep-by-step: set up unattended-upgrades on an Ubuntu or Debian server, check it works, choose when to restart, and cover PHP from extra repositories. https://servernest.io/blog/fail2ban-ubuntu-debianhttps://servernest.io/blog/fail2ban-ubuntu-debianWed, 11 Nov 2026 00:00:00 GMTStep-by-step: install Fail2ban on an Ubuntu or Debian server, block addresses that keep guessing SSH passwords, check who is banned and unban yourself. https://servernest.io/blog/php-fpm-pool-per-sitehttps://servernest.io/blog/php-fpm-pool-per-siteWed, 11 Nov 2026 00:00:00 GMTStep-by-step for Ubuntu and Debian: run each PHP website as its own Linux user with its own PHP-FPM pool, so one hacked site can't read the others. https://servernest.io/blog/ssh-keys-turn-off-password-loginhttps://servernest.io/blog/ssh-keys-turn-off-password-loginWed, 11 Nov 2026 00:00:00 GMTStep-by-step: make an SSH key, add it to your Ubuntu or Debian server, then turn off password login safely without locking yourself out. https://servernest.io/blog/ufw-firewall-ubuntu-debianhttps://servernest.io/blog/ufw-firewall-ubuntu-debianWed, 11 Nov 2026 00:00:00 GMTStep-by-step: turn on the UFW firewall on an Ubuntu or Debian web server, allow only SSH, HTTP and HTTPS, and avoid locking yourself out. https://servernest.io/blog/deploy-laravel-on-your-own-serverhttps://servernest.io/blog/deploy-laravel-on-your-own-serverSun, 08 Nov 2026 00:00:00 GMTA step-by-step Laravel production guide for your own Linux server: safe settings, deploy commands, permissions, scheduler and queue workers. https://servernest.io/blog/do-you-need-a-server-control-panelhttps://servernest.io/blog/do-you-need-a-server-control-panelSun, 08 Nov 2026 00:00:00 GMTCommand line, installed control panel or outside dashboard? A plain guide to the three ways to manage a Linux server, and how to choose. https://servernest.io/blog/run-wordpress-on-your-own-serverhttps://servernest.io/blog/run-wordpress-on-your-own-serverSun, 08 Nov 2026 00:00:00 GMTA practical guide to keeping WordPress safe on your own Linux server: backups, updates, file permissions, cron, login protection and more. https://servernest.io/blog/new-php-server-security-checklisthttps://servernest.io/blog/new-php-server-security-checklistSat, 07 Nov 2026 00:00:00 GMTTen simple steps to make a new Ubuntu or Debian server safer before you host WordPress, Laravel or other PHP websites on it. https://servernest.io/blog/php-versions-security-support-2026https://servernest.io/blog/php-versions-security-support-2026Sat, 07 Nov 2026 00:00:00 GMTA simple table of supported PHP versions in November 2026, what end of life means for your websites, and how to plan PHP upgrades.