Blog on WordPress, Open LiteSpeed, CyberPanel, Linux, FreePBX

Category: WordPress EN

  • Your Server is Secure: A Guide to Permanently Blocking Attacks

    Your Server is Secure: A Guide to Permanently Blocking Attacks

    A Permanent IP Blacklist with Fail2ban, UFW, and Ipset

    Introduction: Beyond Temporary Protection

    In the digital world, where server attacks are a daily occurrence, merely reacting is not enough. Although tools like Fail2ban provide a basic line of defence, their temporary blocks leave a loophole—persistent attackers can return and try again after the ban expires. This article provides a detailed guide to building a fully automated, two-layer system that turns ephemeral bans into permanent, global blocks. The combination of Fail2ban, UFW, and the powerful Ipset tool creates a mechanism that permanently protects your server from known repeat offenders.

    Layer One: Reaction with Fail2ban

    At the start of every attack is Fail2ban. This daemon monitors log files (e.g., sshd.log, apache.log) for patterns indicating break-in attempts, such as multiple failed login attempts. When it detects such activity, it immediately blocks the attacker’s IP address by adding it to the firewall rules for a defined period (e.g., 10 minutes, 30 days). This is an effective but short-term response.

    Layer Two: Persistence with UFW and Ipset

    For a ban to become permanent, we need a more robust, centralised method of managing IP addresses. This is where UFW and Ipset come in.

    What is Ipset?

    Ipset is a Linux kernel extension that allows you to manage sets of IP addresses, networks, or ports. It is a much more efficient solution than adding thousands of individual rules to a firewall. Instead, the firewall can refer to an entire set with a single rule.

    Ipset Installation and Configuration

    The first step is to install Ipset on your system. We use standard package managers for this.

    sudo apt update
    sudo apt install ipset

    Next, we create two sets: blacklist for IPv4 addresses and blacklist_v6 for IPv6.

    sudo ipset create blacklist hash:ip hashsize 4096
    sudo ipset create blacklist_v6 hash:net family inet6 hashsize 4096

    The hashsize parameter determines the maximum number of entries, which is crucial for performance.

    Integrating Ipset with the UFW Firewall

    For UFW to start using our sets, we must add the appropriate commands to its rules. We edit the UFW configuration files, adding rules that block traffic originating from addresses contained in our Ipset sets. For IPv4, we edit /etc/ufw/before.rules:

    sudo nano /etc/ufw/before.rules

    Immediately after *filter and :ufw-before-input [0:0], add:

    # Rules for the permanent blacklist (ipset)
    # Block any incoming traffic from IP addresses in the ‘blacklist’ set (IPv4)
    -A ufw-before-input -m set –match-set blacklist src -j DROP

    For IPv6, we edit /etc/ufw/before6.rules:

    sudo nano /etc/ufw/before6.rules

    Immediately after *filter and :ufw6-before-input [0:0], add:

    # Rules for the permanent blacklist (ipset) IPv6
    # Block any incoming traffic from IP addresses in the ‘blacklist_v6’ set
    -A ufw6-before-input -m set –match-set blacklist_v6 src -j DROP

    After adding the rules, we reload UFW for them to take effect:

    sudo ufw reload

    Script for Automatic Blacklist Updates

    The core of the system is a script that acts as a bridge between Fail2ban and Ipset. Its job is to collect banned addresses, ensure they are unique, and synchronise them with the Ipset sets.

    Create the script file:

    sudo nano /usr/local/bin/update-blacklist.sh

    Below is the content of the script. It works in several steps:

    1. Creates a temporary, unique list of IP addresses from Fail2ban logs and the existing blacklist.
    2. Creates temporary Ipset sets.
    3. Reads addresses from the unique list and adds them to the appropriate temporary sets (distinguishing between IPv4 and IPv6).
    4. Atomically swaps the old Ipset sets with the new, temporary ones, minimising the risk of protection gaps.
    5. Destroys the old, temporary sets.
    6. Returns a summary of the number of blocked addresses.

    #!/bin/bash

    BLACKLIST_FILE=”/etc/fail2ban/blacklist.local”
    IPSET_NAME_V4=”blacklist”
    IPSET_NAME_V6=”blacklist_v6″

    touch “$BLACKLIST_FILE”

    # Create a unique list of banned IPs from the log and the existing blacklist file
    (grep ‘Ban’ /var/log/fail2ban.log | awk ‘{print $(NF)}’ && cat “$BLACKLIST_FILE”) | sort -u > “$BLACKLIST_FILE.tmp”
    mv “$BLACKLIST_FILE.tmp” “$BLACKLIST_FILE”

    # Create temporary ipsets
    sudo ipset create “${IPSET_NAME_V4}_tmp” hash:ip hashsize 4096 –exist
    sudo ipset create “${IPSET_NAME_V6}_tmp” hash:net family inet6 hashsize 4096 –exist

    # Add IPs to the temporary sets
    while IFS= read -r ip; do
        if [[ “$ip” == *”:”* ]]; then
            sudo ipset add “${IPSET_NAME_V6}_tmp” “$ip”
        else
            sudo ipset add “${IPSET_NAME_V4}_tmp” “$ip”
        fi
    done < “$BLACKLIST_FILE”

    # Atomically swap the temporary sets with the active ones
    sudo ipset swap “${IPSET_NAME_V4}_tmp” “$IPSET_NAME_V4”
    sudo ipset swap “${IPSET_NAME_V6}_tmp” “$IPSET_NAME_V6”

    # Destroy the temporary sets
    sudo ipset destroy “${IPSET_NAME_V4}_tmp”
    sudo ipset destroy “${IPSET_NAME_V6}_tmp”

    # Count the number of entries
    COUNT_V4=$(sudo ipset list “$IPSET_NAME_V4” | wc -l)
    COUNT_V6=$(sudo ipset list “$IPSET_NAME_V6” | wc -l)

    # Subtract header lines from count
    let COUNT_V4=$COUNT_V4-7
    let COUNT_V6=$COUNT_V6-7

    # Ensure count is not negative
    [ $COUNT_V4 -lt 0 ] && COUNT_V4=0
    [ $COUNT_V6 -lt 0 ] && COUNT_V6=0

    echo “Blacklist and ipset updated. Blocked IPv4: $COUNT_V4, Blocked IPv6: $COUNT_V6”
    exit 0

    After creating the script, give it execute permissions:

    sudo chmod +x /usr/local/bin/update-blacklist.sh

    Automation and Persistence After a Reboot

    To run the script without intervention, we use a cron schedule. Open the crontab editor for the root user and add a rule to run the script every hour:

    sudo crontab -e

    Add this line:

    0 * * * * /usr/local/bin/update-blacklist.sh

    Or to run it once a day at 6 a.m.:

    0 6 * * * /usr/local/bin/update-blacklist.sh

    The final, crucial step is to ensure the Ipset sets survive a reboot, as they are stored in RAM by default. We create a systemd service that will save their state before the server shuts down and load it again on startup.

    sudo nano /etc/systemd/system/ipset-persistent.service
    “`ini
    [Unit]
    Description=Saves and restores ipset sets on boot/shutdown
    Before=network-pre.target
    ConditionFileNotEmpty=/etc/ipset.rules

    [Service]
    Type=oneshot
    RemainAfterExit=yes
    ExecStart=/bin/bash -c “/sbin/ipset create blacklist hash:ip –exist; /sbin/ipset create blacklist_v6 hash:net family inet6 –exist; /sbin/ipset restore -f /etc/ipset.rules”
    ExecStop=/sbin/ipset save -f /etc/ipset.rules

    [Install]
    WantedBy=multi-user.target

    Finally, enable and start the service:

    sudo systemctl daemon-reload
    sudo systemctl enable –now ipset-persistent.service

    How Does It Work in Practice?

    The entire system is an automated chain of events that works in the background to protect your server from attacks. Here is the flow of information and actions:

    1. Attack Response (Fail2ban):
    • Someone tries to break into the server (e.g., by repeatedly entering the wrong password via SSH).
    • Fail2ban, monitoring system logs (/var/log/fail2ban.log), detects this pattern.
    • It immediately adds the attacker’s IP address to a temporary firewall rule, blocking their access for a specified time.
    1. Permanent Banning (Script and Cron):
    • Every hour (as set in cron), the system runs the update-blacklist.sh script.
    • The script reads the Fail2ban logs, finds all addresses that have been banned (lines containing “Ban”), and then compares them with the existing local blacklist (/etc/fail2ban/blacklist.local).
    • It creates a unique list of all banned addresses.
    • It then creates temporary ipset sets (blacklist_tmp and blacklist_v6_tmp) and adds all addresses from the unique list to them.
    • It performs an ipset swap operation, which atomically replaces the old, active sets with the new, updated ones.
    • UFW, thanks to the previously defined rules, immediately starts blocking the new addresses that have appeared in the updated ipset sets.
    1. Persistence After Reboot (systemd Service):
    • Ipset’s operation is volatile—the sets only exist in memory. The ipset-persistent.service solves this problem.
    • Before shutdown/reboot: systemd runs the ExecStop=/sbin/ipset save -f /etc/ipset.rules command. This saves the current state of all ipset sets to a file on the disk.
    • After power-on/reboot: systemd runs the ExecStart command, which restores the sets. It reads all blocked addresses from the /etc/ipset.rules file and automatically recreates the ipset sets in memory.

    Thanks to this, even if the server is rebooted, the IP blacklist remains intact, and protection is active from the first moments after the system starts.

    Summary and Verification

    The system you have built is a fully automated, multi-layered protection mechanism. Attackers are temporarily banned by Fail2ban, and their addresses are automatically added to a permanent blacklist, which is instantly blocked by UFW and Ipset. The systemd service ensures that the blacklist survives server reboots, protecting against repeat offenders permanently. To verify its operation, you can use the following commands:

    sudo ufw status verbose
    sudo ipset list blacklist
    sudo ipset list blacklist_v6
    sudo systemctl status ipset-persistent.service

    How to Create a Reliable IP Whitelist in UFW and Ipset

    Introduction: Why a Whitelist is Crucial

    When configuring advanced firewall rules, especially those that automatically block IP addresses (like in systems with Fail2ban), there is a risk of accidentally blocking yourself or key services. A whitelist is a mechanism that acts like a VIP pass for your firewall—IP addresses on this list will always have access, regardless of other, more restrictive blocking rules.

    This guide will show you, step-by-step, how to create a robust and persistent whitelist using UFW (Uncomplicated Firewall) and ipset. As an example, we will use the IP address 111.222.333.444, which we want to add as trusted.

    Step 1: Create a Dedicated Ipset Set for the Whitelist

    The first step is to create a separate “container” for our trusted IP addresses. Using ipset is much more efficient than adding many individual rules to iptables.

    Open a terminal and enter the following command:

    sudo ipset create whitelist hash:ip

    What did we do?

    • ipset create: The command to create a new set.
    • whitelist: The name of our set. It’s short and unambiguous.
    • hash:ip: The type of set. hash:ip is optimised for storing and very quickly looking up single IPv4 addresses.

    Step 2: Add a Trusted IP Address

    Now that we have the container ready, let’s add our example trusted IP address to it.

    sudo ipset add whitelist 111.222.333.444

    You can repeat this command for every address you want to add to the whitelist. To check the contents of the list, use the command:

    sudo ipset list whitelist

    Step 3: Modify the Firewall – Giving Priority to the Whitelist

    This is the most important step. We need to modify the UFW rules so that connections from addresses on the whitelist are accepted immediately, before the firewall starts processing any blocking rules (including those from the ipset blacklist or Fail2ban).

    Open the before.rules configuration file. This is the file where rules processed before the main UFW rules are located.

    sudo nano /etc/ufw/before.rules

    Go to the beginning of the file and find the *filter section. Just below the :ufw-before-input [0:0] line, add our new snippet. Placing it at the very top ensures it will be processed first.

    *filter
    :ufw-before-input [0:0]
    # Rule for the whitelist (ipset) ALWAYS HAS PRIORITY
    # Accept any traffic from IP addresses in the ‘whitelist’ set
    -A ufw-before-input -m set –match-set whitelist src -j ACCEPT

    • -A ufw-before-input: We add the rule to the ufw-before-input chain.
    • -m set –match-set whitelist src: Condition: if the source (src) IP address matches the whitelist set…
    • -j ACCEPT: Action: “immediately accept (ACCEPT) the packet and stop processing further rules for this packet.”

    Save the file and reload UFW:

    sudo ufw reload

    From this point on, any connection from the address 111.222.333.444 will be accepted immediately.

    Step 4: Ensuring Whitelist Persistence

    Ipset sets are stored in memory and disappear after a server reboot. To make our whitelist persistent, we need to ensure it is automatically loaded every time the system starts. We will use our previously created ipset-persistent.service for this.

    Update the systemd service to “teach” it about the existence of the new whitelist set.

    sudo nano /etc/systemd/system/ipset-persistent.service

    Find the ExecStart line and add the create command for whitelist. If you already have other sets, simply add whitelist to the line. An example of an updated line:

    ExecStart=/bin/bash -c “/sbin/ipset create whitelist hash:ip –exist; /sbin/ipset create blacklist hash:ip –exist; /sbin/ipset create blacklist_v6 hash:net family inet6 –exist; /sbin/ipset restore -f /etc/ipset.rules”

    Reload the systemd configuration:

    sudo systemctl daemon-reload

    Save the current state of all sets to the file. This command will overwrite the old /etc/ipset.rules file with a new version that includes information about your whitelist.

    sudo ipset save > /etc/ipset.rules

    Restart the service to ensure it is running with the new configuration:

    sudo systemctl restart ipset-persistent.service

    Summary

    Congratulations! You have created a solid and reliable whitelist mechanism. With it, you can securely manage your server, confident that trusted IP addresses like 111.222.333.444 will never be accidentally blocked. Remember to only add fully trusted addresses to this list, such as your home or office IP address.

    How to Effectively Block IP Addresses and Subnets on a Linux Server

    Blocking single IP addresses is easy, but what if attackers use multiple addresses from the same network? Manually banning each one is inefficient and time-consuming.

    In this article, you will learn how to use ipset and iptables to effectively block entire subnets, automating the process and saving valuable time.

    Why is Blocking Entire Subnets Better?

    Many attacks, especially brute-force types, are carried out from multiple IP addresses belonging to the same operator or from the same pool of addresses (subnet). Blocking just one of them is like patching a small hole in a large dam—the rest of the traffic can still get through.

    Instead, you can block an entire subnet, for example, 45.148.10.0/24. This notation means you are blocking 256 addresses at once, which is much more effective.

    Script for Automatic Subnet Blocking

    To automate the process, you can use the following bash script. This script is interactive—it asks you to provide the subnet to block, then adds it to an ipset list and saves it to a file, making the block persistent.

    Let’s analyse the script step-by-step:

    #!/bin/bash

    # The name of the ipset list to which subnets will be added
    BLACKLIST_NAME=”blacklist_nets”
    # The file where blocked subnets will be appended
    BLACKLIST_FILE=”/etc/fail2ban/blacklist_net.local”

    # 1. Create the blacklist file if it doesn’t exist
    touch “$BLACKLIST_FILE”

    # 2. Check if the ipset list already exists. If not, create it.
    # Using “hash:net” allows for storing subnets, which is key.
    if ! sudo ipset list $BLACKLIST_NAME >/dev/null 2>&1; then
        sudo ipset create $BLACKLIST_NAME hash:net maxelem 65536
    fi

    # 3. Loop to prompt the user for subnets to block.
    # The loop ends when the user types “exit”.
    while true; do
        read -p “Enter the subnet address to block (e.g., 192.168.1.0/24) or type ‘exit’: ” subnet
        if [ “$subnet” == “exit” ]; then
            break
        elif [[ “$subnet” =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}\/[0-9]{1,2}$ ]]; then
            # Check if the subnet is not already in the file to avoid duplicates
            if ! grep -q “^$subnet$” “$BLACKLIST_FILE”; then
                echo “$subnet” | sudo tee -a “$BLACKLIST_FILE” > /dev/null
                # Add the subnet to the ipset list
                sudo ipset add $BLACKLIST_NAME $subnet
                echo “Subnet $subnet added.”
            else
                echo “Subnet $subnet is already on the list.”
            fi
        else
            # Check if the entered format is correct
            echo “Error: Invalid format. Please provide the address in ‘X.X.X.X/Y’ format.”
        fi
    done

    # 4. Add a rule in iptables that blocks all traffic from addresses on the ipset list.
    # This ensures the rule is added only once.
    if ! sudo iptables -C INPUT -m set –match-set $BLACKLIST_NAME src -j DROP >/dev/null 2>&1; then
        sudo iptables -I INPUT -m set –match-set $BLACKLIST_NAME src -j DROP
    fi

    # 5. Save the iptables rules to survive a reboot.
    # This part checks which tool the system uses.
    if command -v netfilter-persistent &> /dev/null; then
        sudo netfilter-persistent save
    elif command -v service &> /dev/null && service iptables status >/dev/null 2>&1; then
        sudo service iptables save
    fi

    echo “Script finished. The ‘$BLACKLIST_NAME’ list has been updated, and the iptables rules are active.”

    How to Use the Script

    1. Save the script: Save the code above into a file, e.g., block_nets.sh.
    2. Give permissions: Make sure the file has execute permissions: chmod +x block_nets.sh.
    3. Run the script: Execute the script with root privileges: sudo ./block_nets.sh.
    4. Provide subnets: The script will prompt you to enter subnet addresses. Simply type them in the X.X.X.X/Y format and press Enter. When you are finished, type exit.

    Ensuring Persistence After a Server Reboot

    Ipset sets are stored in RAM by default and disappear after a server restart. For the blocked addresses to remain active, you must use a systemd service that will load them at system startup.

    If you already have such a service (e.g., ipset-persistent.service), you must update it to include the new blacklist_nets list.

    1. Edit the service file: Open your service’s configuration file.
      sudo nano /etc/systemd/system/ipset-persistent.service
    2. Update the ExecStart line: Find the ExecStart line and add the create command for the blacklist_nets set. An example updated ExecStart line should look like this (including previous sets):
      ExecStart=/bin/bash -c “/sbin/ipset create whitelist hash:ip –exist; /sbin/ipset create blacklist hash:ip –exist; /sbin/ipset create blacklist_v6 hash:net family inet6 –exist; /sbin/ipset create blacklist_nets hash:net –exist; /sbin/ipset restore -f /etc/ipset.rules”
    3. Reload the systemd configuration:
      sudo systemctl daemon-reload
    4. Save the current state of all sets to the file: This command will overwrite the old /etc/ipset.rules file with a new version that contains information about all your lists, including blacklist_nets.
      sudo ipset save > /etc/ipset.rules
    5. Restart the service:
      sudo systemctl restart ipset-persistent.service

    With this method, you can simply and efficiently manage your server’s security, effectively blocking entire subnets that show suspicious activity, and be sure that these rules will remain active after every reboot.

  • OpenLiteSpeed (OLS) with Redis. Fast Cache for WordPress Sites.

    OpenLiteSpeed (OLS) with Redis. Fast Cache for WordPress Sites.

    Managing a web server requires an understanding of the components that make up its architecture. Each element plays a crucial role in delivering content to users quickly and reliably. This article provides an in-depth analysis of a modern server configuration based on OpenLiteSpeed (OLS), explaining its fundamental mechanisms, its collaboration with the Redis caching system, and its methods of communication with external applications.

    OpenLiteSpeed (OLS) – The System’s Core

    The foundation of every website is the web server—the software responsible for receiving HTTP requests from browsers and returning the appropriate resources, such as HTML files, CSS, JavaScript, or images.

    What is OpenLiteSpeed?

    OpenLiteSpeed (OLS) is a high-performance, lightweight, open-source web server developed by LiteSpeed Technologies. Its key advantage over traditional servers, such as Apache in its default configuration, is its event-driven architecture.

    • Process-based model (e.g., Apache prefork): A separate process or thread is created for each simultaneous connection. This model is simple, but with high traffic, it leads to significant consumption of RAM and CPU resources, as each process, even if inactive, reserves resources.
    • Event-driven model (OpenLiteSpeed, Nginx): A single server worker process can handle hundreds or thousands of connections simultaneously. It uses non-blocking I/O operations and an event loop to manage requests. When a process is waiting for an operation (e.g., reading from a disk), it doesn’t block but instead moves on to handle another connection. This architecture provides much better scalability and lower resource consumption.

    Key Features of OpenLiteSpeed

    OLS offers a set of features that make it a powerful and flexible tool:

    • Graphical Administrative Interface (WebAdmin GUI): OLS has a built-in, browser-accessible admin panel that allows you to configure all aspects of the server—from virtual hosts and PHP settings to security rules—without needing to directly edit configuration files.
    • Built-in Caching Module (LSCache): One of OLS’s most important features is LSCache, an advanced and highly configurable full-page cache mechanism. When combined with dedicated plugins for CMS systems (e.g., WordPress), LSCache stores fully rendered HTML pages in memory. When the next request for the same page arrives, the server delivers it directly from the cache, completely bypassing the execution of PHP code and database queries.
    • Support for Modern Protocols (HTTP/3): OLS natively supports the latest network protocols, including HTTP/3 (based on QUIC). This provides lower latency and better performance, especially on unstable mobile connections.
    • Compatibility with Apache Rules: OLS can interpret mod_rewrite directives from .htaccess files, which is a standard in the Apache ecosystem. This significantly simplifies the migration process for existing applications without the need to rewrite complex URL rewriting rules.

    Redis – In-Memory Data Accelerator

    Caching is a fundamental optimisation technique that involves storing the results of costly operations in a faster access medium. In the context of web applications, Redis is one of the most popular tools for this task.

    What is Redis?

    Redis (REmote Dictionary Server) is an in-memory data structure, most often used as a key-value database, cache, or message broker. Its power comes from the fact that it stores all data in RAM, not on a hard drive. Accessing RAM is orders of magnitude faster than accessing SSDs or HDDs, as it’s a purely electronic operation that bypasses slower I/O interfaces.

    In a typical web application, Redis acts as an object cache. It stores the results of database queries, fragments of rendered HTML code, or complex PHP objects that are expensive to regenerate.

    How Do OpenLiteSpeed and Redis Collaborate?

    The LSCache and Redis caching mechanisms don’t exclude each other; rather, they complement each other perfectly, creating a multi-layered optimisation strategy.

    Request flow (simplified):

    1. A user sends a request for a dynamic page (e.g., a blog post).
    2. OpenLiteSpeed receives the request. The first step is to check the LSCache.
      • LSCache Hit: If an up-to-date, fully rendered version of the page is in the LSCache, OLS returns it immediately. The process ends here. This is the fastest possible scenario.
      • LSCache Miss: If the page is not in the cache, OLS forwards the request to the appropriate external application (e.g., a PHP interpreter) to generate it.
    3. The PHP application begins building the page. To do this, it needs to fetch data from the database (e.g., MySQL).
    4. Before PHP executes costly database queries, it first checks the Redis object cache.
      • Redis Hit: If the required data (e.g., SQL query results) are in Redis, they are returned instantly. PHP uses this data to build the page, bypassing communication with the database.
      • Redis Miss: If the data is not in the cache, PHP executes the database queries, fetches the results, and then saves them to Redis for future requests.
    5. PHP finishes generating the HTML page and returns it to OpenLiteSpeed.
    6. OLS sends the page to the user and, at the same time, saves it to the LSCache so that subsequent requests can be served much faster.

    This two-tiered strategy ensures that both the first and subsequent visits to a page are maximally optimised. LSCache eliminates the need to run PHP, while Redis drastically speeds up the page generation process itself when necessary.

    Delegating Tasks – External Applications in OLS

    Modern web servers are optimised to handle network connections and deliver static files (images, CSS). The execution of application code (dynamic content) is delegated to specialised external programmes. This division of responsibilities increases stability and security.

    OpenLiteSpeed manages these programmes through the External Applications system. The most important types are described below:

    • LSAPI Application (LiteSpeed SAPI App): The most efficient and recommended method of communication with PHP, Python, or Ruby applications. LSAPI is a proprietary, optimised protocol that minimises communication overhead between the server and the application interpreter.
    • FastCGI Application: A more universal, standard protocol for communicating with external application processes. This is a good solution for applications that don’t support LSAPI. It works on a similar principle to LSAPI (by maintaining permanent worker processes), but with slightly more protocol overhead.
    • Web Server (Proxy): This type configures OLS to act as a reverse proxy. OLS receives a request from the client and then forwards it in its entirety to another server running in the background (the “backend”), e.g., an application server written in Node.js, Java, or Go. This is crucial for building microservices-based architectures.
    • CGI Application: The historical and slowest method. A new application process is launched for each request and is closed after returning a response. Due to the huge performance overhead, it’s only used for older applications that don’t support newer protocols.

    OLS routes traffic to the appropriate application using Script Handlers, which map file extensions (e.g., .php) to a specific application, or Contexts, which map URL paths (e.g., /api/) to a proxy type application.

    Communication Language – A Comparison of SAPI Architectures

    SAPI (Server Application Programming Interface) is an interface that defines how a web server communicates with an application interpreter (e.g., PHP). The choice of SAPI implementation has a fundamental impact on the performance and stability of the entire system.

    The Evolution of SAPI

    1. CGI (Common Gateway Interface): The first standard. Stable, but inefficient due to launching a new process for each request.
    2. Embedded Module (e.g., mod_php in Apache): The PHP interpreter is loaded directly into the server process. This provides very fast communication, but at the cost of stability (a PHP crash causes the server to crash) and security.
    3. FastCGI: A compromise between performance and stability. It maintains a pool of independent, long-running PHP processes, which eliminates the cost of constantly launching them. Communication takes place via a socket, which provides isolation from the web server.
    4. LSAPI (LiteSpeed SAPI): An evolution of the FastCGI model. It uses the same architecture with separate processes, but the communication protocol itself was designed from scratch to minimise overhead, which translates to even higher performance than standard FastCGI.

    SAPI Architecture Comparison Table

    FeatureCGIEmbedded Module (mod_php)FastCGILiteSpeed SAPI (LSAPI)
    Process ModelNew process per requestShared process with serverPermanent external processesPermanent external processes
    PerformanceLowVery highHighHighest
    Stability / IsolationExcellentLowHighHigh
    Resource ConsumptionVery highModerateLowVery low
    OverheadHigh (process launch)Minimal (shared memory)Moderate (protocol)Low (optimised protocol)
    Main AdvantageFull isolationCommunication speedBalanced performance & stabilityOptimised performance & stability
    Main DisadvantageVery low performanceInstability, security issuesMore complex configurationTechnology specific to LiteSpeed

    Comparison of Communication Sockets

    Communication between processes (e.g., OLS and Redis, or OLS and PHP processes) occurs via sockets. The choice of socket type affects performance.

    FeatureTCP/IP Socket (on localhost)Unix Domain Socket (UDS)
    AddressingIP Address + Port (e.g., 127.0.0.1:6379)File path (e.g., /var/run/redis.sock)
    ScopeSame machine or over a networkSame machine only (IPC)
    Performance (locally)LowerHigher
    OverheadHigher (goes through the network stack)Minimal (bypasses the network stack)
    Security ModelFirewall rulesFile system permissions

    For local communication, UDS is a more efficient solution because it bypasses the entire operating system network stack, which reduces latency and CPU overhead. This is why it’s preferred in optimised configurations for connections between OLS, Redis, and LSAPI processes.

    Practical Implementation and Management

    To translate theory into practice, let’s analyse a real server configuration for the virtual host solutionsinc.co.uk.

    5.1 Analysis of the solutionsinc.co.uk Configuration Example

    1. External App Definition:
      • In the “External App” panel, a LiteSpeed SAPI App named solutionsinc.co.uk has been defined. This is the central configuration point for handling the dynamic content of the site.
      • Address: UDS://tmp/lshttpd/solutionsinc.co.uk.sock. This line is crucial. It informs OLS that a Unix Domain Socket (UDS) will be used to communicate with the PHP application, not a TCP/IP network socket. The .sock file at this path is the physical endpoint of this efficient communication channel.
      • Command: /usr/local/lsws/lsphp84/bin/lsphp. This is the direct path to the executable file of the LiteSpeed PHP interpreter, version 8.4. OLS knows it should run this specific programme to process scripts.
      • Other parameters, such as LSAPI_CHILDREN = 50 and memory limits, are used for precise resource and performance management of the PHP process pool.
    2. Linking with PHP Files (Script Handler):
      • The application definition alone isn’t enough. In the “Script Handler” panel, we tell OLS when to use it.
      • For the .php suffix (extension), LiteSpeed SAPI is set as the handler.
      • [VHost Level]: solutionsinc.co.uk is chosen as the Handler Name, which directly points to the application defined in the previous step.
      • Conclusion: From now on, every request for a file with the .php extension on this site will be passed through the UDS socket to one of the lsphp84 processes.
    image 114
    image 115

    This configuration is an excellent example of an optimised and secure environment: OLS handles the connections, while dedicated, isolated lsphp84 processes execute the application code, communicating through the fastest available channel—a Unix domain socket.

    5.2 Managing Unix Domain Sockets (.sock) and Troubleshooting

    The .sock file, as seen in the solutionsinc.co.uk.sock example, isn’t a regular file. It’s a special file in Unix systems that acts as an endpoint for inter-process communication (IPC). Instead of communicating through the network layer (even locally), processes can write to and read data directly from this file, which is much faster.

    When OpenLiteSpeed launches an external LSAPI application, it creates such a socket file. The PHP processes listen on this socket for incoming requests from OLS.

    Practical tip: A ‘Stubborn’ .sock file

    Sometimes, after making changes to the PHP configuration (e.g., modifying the php.ini file or installing a new extension) and restarting the OpenLiteSpeed server (lsws), the changes may not be visible on the site. This happens because the lsphp processes may not have been correctly restarted with the server, and OLS is still communicating with the old processes through the existing, “old” .sock file.

    In such a situation, when a standard restart doesn’t help, an effective solution is to:

    1. Stop the OpenLiteSpeed server.
    2. Manually delete the relevant .sock file, for example, using the terminal command: rm /tmp/lshttpd/solutionsinc.co.uk.sock
    3. Restart the OpenLiteSpeed server.

    After restarting OLS, not finding the existing socket file, it will be forced to create a new one. More importantly, it will launch a new pool of lsphp processes that will load the fresh configuration from the php.ini file. Deleting the .sock file acts as a hard reset of the communication channel between the server and the PHP application, guaranteeing that all components are initialised from scratch with the current settings.

    Summary

    The server configuration presented is a precisely designed system in which each element plays a vital role.

    • OpenLiteSpeed acts as an efficient, event-driven core, managing connections.
    • LSCache provides instant delivery of pages from the full-page cache.
    • Redis acts as an object cache, drastically accelerating the generation of dynamic content when needed.
    • LSAPI UDS creates optimised communication channels, minimising overhead and latency.

    An understanding of these dependencies allows for informed server management and optimisation to achieve maximum performance and reliability.

  • CyberPanel and running out of disk space. XCP-ng, LVM increasing disk size.

    CyberPanel and running out of disk space. XCP-ng, LVM increasing disk size.

    Sometimes it happens that the disk space allocated to our websites on our server turns out to be too small. If our operating system is installed on LVM (Logical Volume Manager), we can relatively easily expand the disk size to what we need. In this article, I will show you how to do it.

    Our working environment:

    • Virtual machine running on XCP-ng
    • Ubuntu 20.04 Server Edition operating system
    • OpenLiteSpeed web server
    • CyberPanel management panel
    • Disk space based on LVM (Logical Volume Manager)

    The 64GB allocated for websites on our server some time ago proved to be too little after a while. After exceeding 80% disk usage, the server slowed down and opening pages became uncomfortable.

    image 108

    What is LVM (Logical Volume Manager)?

    LVM is an extremely flexible tool that allows you to conveniently manage disk space on your servers. LVM can be located on different hard disks and different partitions of different capacities, and we can change the size of the disk space on the fly without even having to restart the computer or virtual machine.

    image 109

    Checking hard disk usage

    To check the usage of our hard disk, use the df command with the -h parameter, which shows the disk size in a human-friendly format.

    In the case of our system, the LVM disk size (/dev/mapper/ubuntu-vg-ubuntu-lv) is 62GB, and 56GB is occupied, which gives 95% disk space usage. This is definitely too little free space for the server to work efficiently. It’s time to allocate more space to the server.

    Increasing disk size in XCP-ng

    For our virtual machine on which the Ubuntu system with a web server is installed, we have only allocated 64GB, so the first step will be to increase the virtual hard disk for our virtual machine. To perform this operation, we will have to turn off our virtual machine for a while. To do this, we run the XCP-ng center application. Then we select the virtual machine we are interested in, and turn it off. We go to the Storage tab, click on the storage we want to enlarge and click Properties. We select Size and Location and increase the size of the virtual hard disk. Then we can restart our virtual machine.

    image 110

    Checking free space in Volume Group

    To display information about our volume groups, type vgs.

    Our volume group is ubuntu-vg with a new size of 126.50GB and it has 63.25GB of free space. To display more information about the volume group, use the vgdisplay command.

    Here we can see that the space allocated to our volume group is 63.25GB and we have another 63.25GB available, which we can add to our volume group.

    Displaying a list of logical volumes

    To display our logical volumes, type lvs.

    In our case, the logical volume ubuntu-lv belongs to the ubuntu-vg volume group.

    NOTE: Remember to replace our volume names with your own when typing commands.

    Increasing the size of our logical volume

    To assign more disk space to our volume group, we will use the lvextend command. Remember to replace ubuntu-vg and ubuntu-lv with the volumes used in your system.

    The -L parameter allows us to specify the size by which we want to increase our logical volume, in our case we are increasing it by 63.25GB.

    Note: Remember that we do not specify units TB, GB, MB etc., but P for Petabytes, T for Terabytes, G for Gigabytes, M for Megabytes etc.

    After re-entering the vgdisplay command, we see in the Alloc PE/Size field that the additional disk space has been correctly allocated.

    Enlarging the file system

    Our new disk space is not yet visible to the system. We must first enlarge the file system with the resize2fs command.

    By giving the resize2fs command, we must indicate where our logical volume is mounted, in our case it is /dev/mapper/ubuntu--vg-ubuntu--lv.

    After this operation, our new disk space is already visible to the operating system and CyberPanel. 47% disk usage is a decent result and should be enough for a while.

    image 111

    Summary

    As you can see, LVM has many advantages. If you had an operating system installed on normal disks and partitions, you probably would not be able to do without formatting the disks and installing the system from scratch. Whereas LVM allows you to add a new disk to your computer, create a partition on it and add it to an already existing group of volumes and logical volumes. Easy, fast and enjoyable.

    If you have any questions about increasing the capacity of LVM volumes, do not hesitate to ask them in the comments.

  • From a Text File to an Online Game: A Complete Guide to Deploying a React App

    From a Text File to an Online Game: A Complete Guide to Deploying a React App

    Do you have the code for a React game ready, but it’s all in a single text file? Do you want to host this game on your WordPress site, in a specific subdirectory, and be able to update it easily? This guide will walk you through the entire process, step by step, from creating the project and configuring it, to publishing and troubleshooting common issues.

    Step 1: Creating the Project Structure from a Code File

    The first challenge is to transform a loose code file into a fully-fledged, working React project. Simply having a .txt file isn’t enough – we need a complete structure of folders and configuration files to install dependencies and build the application.

    We’ll use Vite, a modern build tool, to quickly generate a React project structure.

    1. Create the project:npm create vite@latest movie-quiz -- --template react
      This command creates a new folder named movie-quiz and fills it with a complete, minimal React project template.
    2. Install dependencies:cd movie-quiz npm install
      After entering the new folder, npm install reads the package.json file and downloads all the necessary libraries into a node_modules subfolder.

    Once these steps are complete, you’ll have a ready-to-use project structure. Now, simply copy the code from your Quiz game Movies - React.txt file and paste it into src/App.jsx, replacing the default content.

    Step 2: Configuring Tailwind CSS

    If your code, like ours, uses style classes from Tailwind CSS (e.g., bg-gray-50, font-bold), we need to add it to the project. The latest versions of Tailwind integrate with Vite very easily.

    Install the plugin:npm install @tailwindcss/vite

    Update the Vite configuration: Open the vite.config.js file and add the Tailwind plugin:

    import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
import tailwindcss from '@tailwindcss/vite'

export default defineConfig({
  plugins: [
    react(),
    tailwindcss(),
  ],
})

    Import the styles: Open the src/index.css file, delete its content, and paste in this single line:@import "tailwindcss";

    After these steps, the application, when run with npm run dev, should display correctly with all styles applied.

    Step 3: Publishing the Game in a WordPress Subdirectory

    Once the game is working locally, we can publish it online.

    1. Configure the base path: To make the game work in a subdirectory (e.g., /quiz-game/), we need to add the base: '/quiz-game/' option to the vite.config.js file. This is a crucial step that ensures all paths to assets (CSS, JS) in the built application are correct.
    2. Build the production version:npm run build
      This command creates a dist folder containing optimised, static files of your game, ready for publishing.
    3. Upload the files to the server: Using an FTP client, connect to your server, create a quiz-game subdirectory in your main WordPress folder, and upload the contents of the dist folder into it.
    4. Configure .htaccess: To ensure that refreshing the page within the game works correctly, create a .htaccess file inside the quiz-game folder on the server. This file should contain rules to redirect all requests to the game’s index.html file, preventing WordPress from taking over the routing and showing a 404 error.

    Step 4: Updating the Game

    The process for updating the game (e.g., adding new questions) is simple and cyclical:

    1. Modify the code: Change the project files on your computer (e.g., add questions in src/App.jsx).
    2. Rebuild: Run npm run build to create a new version of the files in the dist folder.
    3. Publish: Connect to the server, delete the old contents of the quiz-game folder, and upload the new contents from the dist folder in its place.

    Glossary of Commands Used

    • npm create vite@latest [name] -- --template react: Creates a new, ready-to-use React project using Vite.
    • cd [folder-name]: (Change Directory) Changes the current directory in the terminal.
    • npm install: Reads the package.json file and installs all necessary libraries.
    • npm install [package-name]: Installs a specific, additional package.
    • npm run dev: Starts a local development server with live preview.
    • npm run build: Creates an optimised, production version of the application in the dist folder.
    • npx [command]: Executes a command from a package installed locally in the project.
    • nvm install [version]: Installs a specific version of Node.js using NVM.
    • nvm use [version]: Switches the active version of Node.js in the terminal.
    • rm -rf [folder-name]: (Remove) Deletes a folder and all of its contents.
    Quiz game 1 1
    Quiz game 2 1
    Quiz game 3 1

    Troubleshooting (FAQ)

    Here we’ve collected the errors we encountered during the process, along with their solutions.

    Error: Could not read package.json

    Problem:

    Attempting to run an npm command like npm run build in a folder that only contains a code file, not a full project structure.

    Solution:

    You must first create a full project structure using a command like npm create vite@latest project-name — –template react, and only then move your code into it and run npm commands.

    Error: could not determine executable to run

    Problem:

    The command npx tailwindcss init -p fails. npx is unable to find and run the tailwindcss package.

    Solution:

    This error can have many causes, from a corrupted npm cache to path issues on your system. The most effective solution is to bypass the problem by using the modern Tailwind integration with Vite (described in Step 2), which doesn’t require running this command manually. However, if you must run it, first try a clean install (rm -rf node_modules package-lock.json, followed by npm install).

    Error: Message about the PostCSS plugin for Tailwind

    Problem:

    After starting the development server, an error appears stating that the PostCSS plugin for Tailwind has been moved to a separate package.

    Solution:

    This error occurs when trying to use an older configuration method with the latest version of Tailwind CSS (v4+). The correct solution is to use the official @tailwindcss/vite plugin, which automates the entire process. You need to install the plugin, add it to your vite.config.js file, and remove the old configuration from postcss.config.js (if it exists).

  • Phishing: Why Companies Fall Victim to Their Attacks

    Phishing: Why Companies Fall Victim to Their Attacks

    Over time, phishing attacks have become increasingly sophisticated. Thanks to public information campaigns on television, more people have become aware of the threats and know what to look out for after receiving messages from uncertain sources. However, criminals are also constantly adapting their attack methods to changing circumstances, and many people still fall victim to these types of attacks, losing confidential or private data, and even their savings. The matter is even more serious when we talk about phishing attacks on companies that hold confidential data of their customers in their databases. How is it possible that companies still fall victim to such attacks?

    image 31

    Lack of Employee Security Training

    Training employees is a cost to the company. Therefore, in the name of saving money, it turns out that business owners are abandoning training their employees in the field of cyber-security. Untrained employees do not know how to avoid ever-new security threats. Without proper training, they may not realise how serious a threat phishing can be to the company, how to detect it, and how to protect themselves against it. A lack of employee training can end in disaster for the enterprise and cause the company many problems, including legal ones. Training is essential to know how to recognise a phishing message in the first place.

    As long as business owners ignore the problem of a lack of employee training, companies will continue to fall victim to phishing attacks. The cost incurred for training in cyber-crime can pay for itself in the future, and ignoring this type of threat can come back to haunt them.

    The problem affects small companies to an even greater extent than large enterprises, as large companies can usually allocate more funds for training, because the cost per employee for such training will be lower than in small firms with a few or a dozen employees. Furthermore, the IT infrastructure of large companies is generally much better protected against cyber-attacks than in small businesses.

    Money

    Cyber-criminals make money from phishing attacks. Often, large sums of money. Obtaining confidential data, for example, login details for banking websites, from unsuspecting employees is much easier than hacking directly into the banks’ websites. That is why, despite the passage of time, phishing attacks are still going strong. New, ever more sophisticated methods of phishing attacks are constantly emerging.

    Cyber-criminals are often able to invest considerable funds in purchasing software and hardware to carry out these types of attacks. This, combined with the unawareness of untrained company employees, means that tens of thousands of data-phishing sites are detected each year. According to The Anti-Phishing Working Group, over a million phishing attacks were detected in the first quarter of 2022. In March 2022, over 384,000 data-phishing sites were discovered. This is a really serious problem for private individuals and an even bigger problem for companies.

    image 32

    Careless Employees

    Sometimes it is not the company itself that is responsible for falling victim to phishing, but the carelessness and negligence of individual employees, even despite appropriate training being conducted. Clicking on links and entering confidential data on websites without thinking can result in the leakage of login data. Any employee with access to websites at work can fall victim to phishing.

    Easy Access to Software for Criminals

    In the past, only a handful of hackers in the world had the skills to write software to carry out effective phishing attacks. Today, in the age of the ubiquitous internet, with the right amount of cash, criminals are able to easily acquire professional tools and software to carry out phishing attacks. That is why the number of these attacks is growing year on year.

    Companies Are Looking for Savings

    Recent years, 2020-2022 (the coronavirus pandemic, high energy prices), have not been easy for entrepreneurs. It is no wonder, then, that companies looking for savings are tightening their belts and giving up on employee training. However, saving on a company’s cyber-security can come back to haunt them in the future.

    Summary

    The problem of phishing attacks, especially on companies, is growing year on year, and their methods are becoming more and more sophisticated. Therefore, taking care of the security of company data and the confidential data of our clients is extremely important. That is why professional training for office employees in the field of security is extremely important. Such training is offered by many companies, such as Network Masters or Securitum, both online and in-person. It is also extremely important to properly secure our company’s IT infrastructure itself. A good quality firewall can automatically detect and block many types of attacks on our company’s computer systems, including phishing.

  • How to Create an Estate Agency Website in WordPress

    How to Create an Estate Agency Website in WordPress

    Estate agency websites differ slightly from those in other industries. Creating such a site in WordPress isn’t just a matter of uploading a few photos and a property description. This type of website requires the latest knowledge in web development. Some features for this kind of site are quite easy to implement using free or paid plugins, many of which can be found in the WordPress repository. However, implementing some advanced functions may require hiring a specialist in web development, databases, and PHP. Unique features can help your website stand out from the competition. In this article, we will look at the key stages of creating such a website, as well as interesting features you could install on your site.

    image 26

    Key Features of Estate Agency Websites

    An estate agency website is not just about having an online presence. What’s important is the graphic design with high-quality photos, a clear property search engine with detailed filtering options, and a form to arrange a viewing.

    Key features of any estate agency website:

    • Detailed Information: Try to include as much detailed information as possible. Without it, it will be harder to sell or let a property.
    • Photographs: The more, the better. Photos are what primarily draw attention to a listing, and users rely on them when searching for a house or flat.
    • Contact Details: It is advisable to provide various contact options, not just a phone number: email addresses, instant messengers, etc.
    • Online Viewings: These allow estate agents to show properties or negotiate offers with clients who do not live in the local area.
    • Maps: These will help interested parties to understand the property’s location.
    • Search Filters: A client who has to browse through dozens of pages of listings they are not interested in to find their dream home might get bored before they find it. A good search engine is not just about simple sorting by price. Some people care about the neighbourhood, proximity to a school or a tube station; some are looking for ground-floor flats, while others want a third-floor flat, and others won’t even consider listings without a garden. Provide your users with a well-organised search engine, and your site will sell many properties.

    Stages of Creating an Estate Agency Website

    The creation of most websites consists of several stages. Remember, however, that website development never truly ends; to be well-positioned in Google, the site must be regularly updated.

    Stage One: Choosing a Theme

    The first and one of the most important steps is choosing the theme upon which your website will be built. A good theme for an estate agency might already have a built-in function you need, so you won’t have to install an additional plugin later, and some extra plugins can be quite expensive. Therefore, take your time. Think about which features are most important to you and spend some time checking several, or even a dozen, different themes. Don’t focus on the visual aspect of the site – because that can be relatively easily customised to your needs – but rather on the functional side of a given theme. Choosing the first theme you come across without thinking can come back to haunt you in the future.

    Here are a few recommended themes:

    • RealHomes (Paid): It has a powerful search engine with lots of options, custom photo galleries, and additionally, a dozen different graphic layouts to choose from. The theme allows for attaching documents to each property offered – PDF files, office documents, scans, etc. It is possible to add floor plans for each level of the building. You can very easily and quickly edit property details. A useful feature is the ability to compare individual listings or search for similar properties.
    image 27
    • NexProperty (Free): This is a completely free theme. It was originally created more for occasional property rentals, but it can be relatively easily transformed into a professional estate agency website. This theme has a decent search engine and allows for the convenient placement of all offered properties on a map. It features a clear booking page for appointments and a subpage for staff members. A recommended free alternative to other paid themes.
    image 28
    • VW Real Estate (Free and Paid): A visually interesting theme with a lot of graphical flourishes. It has a simple property search engine. It is also possible to purchase a paid option with technical support, multi-language support, and better SEO optimisation.
    image 29
    • Houzez (Paid): An excellent, extremely flexible theme. There are over a dozen graphic styles to choose from. The theme’s back-end is brilliantly organised, where we can manage properties and clients. Convenient reports allow for detailed analysis. A professional and highly recommended theme.
    image 30

    Stage Two: Selecting and Installing Plugins

    Thanks to plugins, you can quickly and without coding extend the functionality of your website. Most of the plugins needed for an estate agency can be found in the WordPress plugin repository. A noteworthy plugin is Realtyna Organic IDX plugin WPL. It allows for the convenient addition and management of property listings.

    Stage Three: UX/UI Design

    Creating an interesting and unique design is a complex but satisfying process. To ensure the site’s success, it is important to target the right audience and make the site easy to use on both computers and smartphones. A convenient property search is one of the most important elements of an estate agency website. It should search for listings based on all relevant parameters: number of rooms, flat area, location, garage availability, etc.

    Stage Four: Implementing Additional Features

    The final stage should be the implementation of all additional functions that an estate agency website should have but cannot be implemented using WordPress plugins. If you are not a professional coder, you will need the help of a specialist for this. An interesting option could be, for example, an application for Android or iOS phones. Help with obtaining a mortgage or even comparing offers from different banks could be useful for a potential client.

    Summary

    Creating a professional estate agency website is not just about choosing a theme and listing properties. It requires creating a good and unique graphic design, ensuring a great user experience, and designing an effective property search engine. Taking care of each of these aspects will certainly result in acquiring a large number of potential clients.

  • WordPress vs Weebly: A Comparison

    WordPress vs Weebly: A Comparison

    WordPress and Weebly are popular website-building platforms that allow you to create websites with virtually no knowledge of HTML, JavaScript, or CSS. On both platforms, the method of creating pages is similar, but not identical. In this article, we will show you the differences between them so you can choose the best solution for your website. Read the full article to learn what distinguishes WordPress from Weebly.

    WordPress

    WordPress is a content management system (CMS) used for creating and managing websites. It is an open-source platform, completely free to download and use. WordPress is hugely popular, holding over 64% of the CMS market. The second CMS on the podium is Shopify, which has just 5.6%.

    In 2025 Weebly holds a 0.7% market share of all the websites that use CMS. Weebly is used by 0.5% of all websites. Weebly is presently used on 508,756 websites. Most of the Weebly-powered websites (specifically, 380,849) are registered in the US.

    image 24

    One of the biggest advantages of WordPress is its flexibility: you can use it to create a simple personal website, a comprehensive corporate site, an online shop, a blog, or a forum. There are thousands of free and paid extensions, plugins, and themes available for WordPress, which allow the user to customise both the appearance and functionality of the site. As the most popular CMS in the world, WordPress has a large and active community of users, so you can count on extensive support if you encounter problems.

    However, WordPress sometimes requires a certain amount of technical knowledge to be used effectively. You won’t need any coding experience to create a simple website, but to build a large site with an online shop perfectly tailored to your needs, you will need at least a basic knowledge of HTML, CSS, JavaScript, and PHP.

    There are two versions of WordPress available: WordPress.org, which is available for download but requires separate hosting and a domain that you will have to arrange on your own, and WordPress.com, which provides both hosting and a domain for your site. Depending on the disk space, availability of technical support, and available extensions, there are many pricing options.

    WordPress – Key Features

    WordPress is a powerful and feature-rich content management system. Here are its key features:

    • Customisation: You have enormous possibilities to tailor your site to your needs. If a certain functionality is missing, you can download free and paid plugins that extend the site’s capabilities and help customise its appearance.
    • Content Creation and Management: With WordPress, you can easily create and edit blog posts, pages, media files, and much more. A huge convenience is the history of changes on your site, where you can restore the page to a version before an edit in case of problems.
    • SEO and Marketing: WordPress includes a range of built-in features that facilitate search engine optimisation (SEO) and marketing activities, such as fully configurable URLs, the ability to add meta-tags and descriptions, and integration with social media and email marketing platforms.
    • User Management: WordPress allows for the creation of multiple user accounts with assigned roles and permissions, which facilitates management and enables collaboration among many people in creating the website.
    • E-commerce: WordPress can be successfully used to create a professional online shop using e-commerce plugins like WooCommerce. These plugins offer payment gateway integration, allowing customers on your site to pay by card, PayPal, or many other payment systems. You will also be able to manage inventory and shipping.
    • Multi-language Support: WordPress supports the creation of multilingual websites through plugins. For example, the popular WPML plugin allows for the translation of content into many languages, thereby reaching a wide audience.

    WordPress – Support

    WordPress is an open-source platform with a huge and active user community, which means it’s easy to get the help you need if you have problems with your site. You have several options for getting help with WordPress:

    • WordPress.org Support Forum: The WordPress.org support forum is a good place to start looking for help with a problem on your site. You will find not only users of this CMS but also the people who create WordPress, so you can count on professional help.
    • WordPress.org Documentation: Many of your site’s problems have probably already been solved and described. Just check the documentation to solve the problem quickly and efficiently. If you haven’t had previous contact with WordPress, be sure to start with the provided guides.
    • WordPress.com Support: If you use the paid version hosted on WordPress.com, you can get help through the Support Centre, where you will find a knowledge base, tutorials, and a community forum.
    • Professional Support: If you need support to solve more serious problems or to extend the functionality of WordPress, you can hire a professional WordPress developer. You will certainly find someone trustworthy in your area, and if not, most of the work can be done remotely.
    • Local WordPress Community: If you live in a larger city, you might find a local group of WordPress enthusiasts who promote the system. Such groups can be an invaluable help in solving problems with WordPress.

    WordPress Pricing

    There are two versions of WordPress: WordPress.org, which is completely free but requires you to purchase a domain and hosting separately, and WordPress.com, which has one free plan and four paid ones.

    WordPress.org

    • You can download, install, and use WordPress.org for free. However, you will need to purchase your own domain and hosting, which is where your site’s files will be stored, and this involves additional costs.
    • Hosting costs can vary greatly, starting from around £7-£10 per year for shared hosting, up to £60-£70 per year or more for a virtual private server (VPS).
    • Domain prices can also vary significantly depending on the extension and registrar, but typically a standard .co.uk or .com domain costs from a few to several pounds per year.

    WordPress.com

    • WordPress.com offers several paid pricing plans and one free plan with limited disk space, limited features, and no option to choose a custom domain.
    • The free plan includes a https://www.google.com/search?q=yourname.wordpress.com subdomain, 1GB of file space, and basic options sufficient for creating a simple site.
    • Paid plans start from £3 per month and, in addition to more disk space, also offer greater functionality. You can see the differences between the free and paid packages on the wordpress.com website.

    The final cost of maintaining your website will depend on your specific needs and the version of the platform you choose. If you choose the free WordPress.org version, you will have to add the costs of hosting and a domain. If you choose the free WordPress.com version, you will not incur any costs, but you must be aware of limitations, the inability to choose your own domain, and ads on the site. If you choose a paid WordPress.com plan, you must consider the monthly subscription costs.

    WordPress Customisation

    WordPress (apart from the free WordPress.com version) provides enormous possibilities for changing the appearance and settings of the site. The possibilities are practically limitless. There are several different ways to change the look or function of WordPress:

    • Themes: Also known as templates, these control the appearance and sometimes the functionality of your site. There are thousands of free and paid themes available. To install a new theme, simply go to the WordPress dashboard and click: Appearance > Themes.
    • Plugins: This is software that adds various functionalities to your site. You can choose from thousands of free and paid plugins, ranging from simple add-ons to powerful tools that can turn your site into a professional online shop.
    • Custom Code: If you can code, there is nothing to stop you from changing the HTML, CSS, and PHP code of WordPress yourself to personalise the site’s appearance.
    • Widgets: These are small blocks of content that can be placed in various areas of your site.
    • Menus: WordPress allows you to create custom menus that can be placed in the header, sidebar, footer, or on any page.

    Using these options, you can create a unique site tailored to your needs.

    WordPress Themes

    Themes control the visual aspect of your website. They are essential for WordPress to function. In just a few clicks, you can completely change the site’s appearance, colours, fonts, and menus. There are thousands of free and paid themes available, tailored to different industries, professions, and specialities. Whether you’re a carpenter or a lawyer, there are dozens of templates available for you.

    There are themes for business, blogging, hobbies, and themes adapted for online shops; everyone is sure to find something for themselves. Simply log in to the WordPress dashboard, click Appearance and Themes, then Add New Theme.

    After installing a theme, you can, of course, customise it to your needs by choosing your favourite font, colour scheme, or site layout. Don’t be afraid to experiment with themes—changing a theme does not affect the data on the site, and you can always safely revert to the previous theme if the new one is not to your liking. However, remember to only install themes from trusted sites. Themes installed from suspicious sources may contain viruses and steal your data. It is crucial to follow best practices for WordPress security to protect your site.

    WordPress Plugins

    Plugins are software that adds new functionalities to our site. The huge number of plugins is a major advantage of WordPress. Thanks to plugins, we can improve site security, enhance our site’s position in Google search results, or turn our site into a professional online shop.

    WordPress has its own plugin repository, which greatly simplifies searching for and installing them, but you can also find them on other websites, download them, and install them manually. In the repository, you will find plugins for contact forms, making backups, social media integration, and much more.

    Installing plugins is incredibly simple. Just log in to the dashboard, click on Plugins, and Add New. After finding the plugin that interests you, just click Install. After installation, you must activate the plugin for it to start working, and some of them also require initial configuration. It is worth reading the text files provided by the plugin creator to learn how to use it, as different plugins are operated slightly differently.

    image 25

    Although plugins have many advantages, they should be installed with caution.

    • An excessive number of plugins can result in slowing down your website.
    • Some plugins from the same category can interfere with each other’s work and cause problems.
    • Each plugin is additional code, and the more code, the greater the chance of a security breach and the possibility of your site being hacked.

    WordPress and SEO

    WordPress includes a number of built-in features that can help optimise our site for search engines. SEO is the process of optimising a website to achieve the best possible position in search results for specific phrases and attract more organic traffic. Here are a few ways WordPress can help you with SEO:

    • Clean Code: WordPress builds pages according to standards that are easily read by search engine crawlers.
    • Custom URLs: WordPress allows you to create custom URLs for pages and blog posts, which helps crawlers better categorise the pages of your site.
    • Alt tags for images: You have the ability to add alternative descriptions to images so that browsers can better categorise subpages.
    • Header tags: Thanks to header tags, search engine crawlers can instantly recognise the content of a page without having to scan the entire text.
    • SEO Plugins: Basic SEO functionalities can be significantly expanded with additional plugins. Thanks to them, you can perform detailed keyword analysis, create meta-tags, generate XML sitemaps, and much more. Popular plugins include Yoast SEO and All in One SEO Pack.

    By adhering to Google’s guidelines, we have a chance to improve our site’s visibility in search results and attract more visitors. Remember that maintaining high positions in Google results requires continuous effort, and a place in the top ten once gained can easily be lost.

    Weebly

    Weebly does not offer the option to install its product on a hosting of your choice. The only option is to install it on Weebly’s hosting, but in the paid plans, you have the option to choose your own domain. Weebly allows you to create a professional-looking website in an incredibly simple way, without needing any coding skills. Most of the work, apart from entering content, is done using the “drag and drop” method. You can, of course, add contact forms to the site, create a good-looking blog, and even set up an online shop. This is not surprising, as since 2018, Weebly has been owned by Square (now Block), which has long handled payment systems for a huge number of online stores.

    Key Features of Weebly

    • Incredibly easy to use: You build a site in Weebly by dragging elements from the menu to the appropriate places on the page. Absolutely anyone can handle it.
    • Templates: Weebly offers a large selection of templates that will allow you to customise the look of your site to your individual needs.
    • Customisable pages: You have the ability to create custom pages, like ‘Contact’ or ‘About’, and add text, photos, and even videos to them.
    • E-commerce: In the more expensive plans, you get a package of features for building an online shop with an integrated card payment system, a shopping basket, and inventory management.
    • Blog: Thanks to Weebly, you can easily create a blog page.
    • SEO Tools: Weebly includes built-in tools that will help you optimise your site for search engines. You can, among other things, add keywords or meta descriptions.
    • Mobile Optimisation: Weebly automatically optimises pages for mobile devices. Thanks to this, your site will look great not only on computer screens but also on tablets and smartphones.
    • Customer Support: Even with the free version, you have access to technical support via chat, email, and a forum, and in the more expensive plans, additionally by phone.

    Weebly Pricing

    • Weebly offers one free plan and several paid plans that differ in price and functionality.
    • Free: In the free plan, you can set up a site on a .weebly.com subdomain. You have access to the drag-and-drop site builder, templates, and basic features like contact forms and Google Analytics integration. However, you cannot launch an online shop or use your own chosen domain.
    • Connect: In this plan, you can choose your own domain and have access to basic e-commerce functionality, such as a shopping basket and online payment processing.
    • Pro: The Pro plan offers extended e-commerce features, such as abandoned basket recovery and the ability to offer discounts and coupons. It also includes more customisation options, like using custom fonts or password-protecting individual pages.
    • Business: You get even more e-commerce capabilities, like advanced shipping options or the ability to create gift cards. There are also several features for business, such as membership-based websites and the ability to create custom reports.

    You can get better prices with annual billing compared to monthly payments. You also have the option to test the packages during a 30-day trial period.

    Weebly Customer Support

    Weebly offers technical support through a forum, email, chat, and, in more expensive packages, also by phone. Additionally, there is access to a Knowledge Base, a blog with tips, and tutorials.

    Weebly Customisation

    Weebly allows users to customise their sites in various ways.

    • Templates: Weebly offers many templates to choose from, which are fully configurable and can be easily modified using the drag-and-drop method.
    • Custom domain: In paid packages, you have the option to use your own domain, but you must buy it yourself and connect it to Weebly.
    • Custom fonts: In the Pro and Business plans, you can use custom fonts on your pages.
    • Custom code: You can add custom HTML, CSS, and JavaScript code to your pages.
    • Plugins: Weebly also offers a repository of plugins, but there are not as many as in WordPress.

    Weebly and SEO

    Weebly includes a range of tools that will help you optimise your site for search engines like Google or Bing. These tools can help you improve your site’s visibility in search results, which can lead to an increase in visits and potential customers.

    • Meta tags: You have the ability to add meta tags, such as a title and description, to every page of your site.
    • Image optimisation: You can add alternative text to images.
    • SEO Tools: Weebly includes a built-in SEO builder that provides tips and recommendations for optimising your site for search engines.
    • Mobile optimisation: Weebly automatically optimises websites for mobile devices, which is important because for some time now, Google has been using mobile-first indexing. This means that the mobile version will determine the site’s position in the search engine.
    • Custom URLs: You can create custom addresses for each of your pages, which can improve the page’s position in search results.

    By using the tools above and adhering to good SEO practices, you have a chance to achieve high rankings in Google results.

    Summary

    The final choice will depend on your specific needs and level of technical knowledge. If you don’t know JavaScript, CSS, or even HTML, it will be safer to choose Weebly. However, if you plan to expand your site in the future and add new functionalities, I would suggest choosing WordPress.

    WordPress has a much, much larger selection of plugins that extend the site’s functionality. And even if a plugin you need for specific tasks doesn’t exist, you can ultimately hire a developer to create such a plugin for you. With Weebly, it’s different—if a certain functionality is not available and a plugin that could fix it doesn’t exist, you have to accept that you won’t be able to implement that feature on the site. In that case, the only option left is to change platforms, which can be time-consuming and costly.

  • How to Remove Pop-up Ad Malware from a WordPress Site

    How to Remove Pop-up Ad Malware from a WordPress Site

    When creating a website, you should pay special attention to its security. A breach of your site’s security can lead to significant problems. If your site allows user logins, or worse, you have an online shop (e.g., WooCommerce) with a customer database, it could result in a personal data leak and serious consequences, even legal action. In this article, you will learn how to remove pop-up ad malware from a WordPress site.

    What’s more, the wide variety of WordPress plugins and themes means that security breaches of this CMS are not uncommon. This is not surprising, considering that there are up to 90,000 attacks on WordPress sites per minute worldwide.

    It’s not that WordPress isn’t secure enough – it’s simply the most popular CMS in the world, and therefore the most frequently attacked. Its popularity is so great that, according to the company Sucuri, attacks on the WordPress platform account for 90% of all attacks on CMS systems.

    Symptoms of a Malware Infection

    To effectively combat malware that has infected your website, you first need to know that your site has been infected at all. Sometimes you may not even realise that your site is infected and is sending spam in the background to thousands of people about pornography or potency pills. In this article, we will help you recognise the symptoms of a malware infection.

    One of the most obvious signs of a malware infection on your site is visible changes you didn’t make, or strange meta descriptions in the SERPs (Search Engine Results Pages). Furthermore, a common symptom of infection is pop-ups, adverts, or redirecting users to a completely different, spammy website.

    As a WordPress site administrator, you must bear in mind that you cannot see some changes from the back-end (Dashboard). Only users visiting your site will see the annoying pop-ups.

    Another very obvious symptom of infection will be the blacklisting of your site by Google. Google may then warn users trying to access your site with a large red alert, and in extreme cases, even remove your site from the Google SERPs.

    image 23

    A website infected with malware may also be taken down by your hosting provider if it is on a shared server, to protect the owners of other websites hosted on the same server.

    If your site does not appear in Google search results, or does not open when you type its address into the browser, it is quite possible that it has been infected and removed from the Google index or from your provider’s server.

    How to Clean a Website of Malware

    Use a Malware Removal Plugin

    If you can log in to your WordPress dashboard, the quickest way to get rid of malware is to use plugins designed for this purpose.

    Plugins like Wordfence, Sucuri, or iThemes are some of the best plugins for protecting your WordPress-based site.

    If you have no experience in administering web servers (Apache, LiteSpeed, Nginx) or Linux, this is the fastest and safest method to combat malware.

    Manual Malware Removal

    Manually removing malware is time-consuming and, if files are edited or deleted incorrectly, can result in your website becoming completely immobilised. However, if you cannot access the WordPress dashboard to install the necessary plugins, manually searching for and removing malware is often the only option. If you have no experience in this, it is safest to consult a company that does this professionally to avoid causing even more damage.

    Create a Site Backup

    Before you do anything to remove the malware from your site, first create a backup of the website so that you can restore it in case of complications. Creating backups should become a habit, which will save you a lot of time and stress in case of website problems.

    To manually back up your site’s files, log in to your hosting using FTP, SFTP, or via the CyberPanel. Then, compress the contents of the wp-content folder and download the compressed file to your computer’s hard drive.

    If your hosting has a snapshot backup option, this is also a good choice, or you can use one of the many WordPress plugins for this purpose.

    It will also be necessary to back up the .htaccess file. This file is hidden by default in some file managers, so make sure you have the option to show system files enabled.

    It is equally important to back up the database, as this is where most of the information displayed on our site is stored. Bear in mind that some malware can hide in the database itself.

    Reinstall WordPress

    Before you start looking for malware in your files, install a clean version of WordPress. By installing a fresh version of WordPress from the official website, you can be sure that it is free of malware.

    Check the Files

    The most difficult part of the task is ahead of you – checking all the WordPress files. This is a tedious and lengthy process, as you will have to check each file and directory one by one to identify infected files.

    First, compare all WordPress files with the files from your backup, then proceed to check the theme and plugin files. If you have no experience in creating and editing HTML, CSS, or JavaScript files, it may be very difficult for you to spot suspicious lines of code.

    After reviewing all the WordPress files, check the contents of the .htaccess file. This is a very important file, and even after installing a clean version of WordPress, if you have an infected .htaccess file, you may still leave a backdoor open for hackers to reinfect your site with malware.

    Finally, after thoroughly checking and cleaning all files, you should also clear your browser and web server cache, as files in the cache can also be infected and reinfect your site.

    Reinstall Themes and Plugins

    Reinstall clean versions of your themes and plugins. Remember to only install trusted themes and plugins. The truth is that most malware infections are not caused by WordPress itself, but especially by installing poor-quality plugins and themes, or worse, installing them from untrustworthy sources. Such plugins are often already infected at the time of installation.

    Reset All WordPress and phpMyAdmin User Passwords

    This is an absolutely necessary step when dealing with malware. Often, the weakest link on our website is not WordPress itself, but weak passwords that are easy to guess or break using the Brute Force method. It is also worth checking the list of users on our site to see if there are any suspicious individuals with high privileges who were not there before.

    It is also essential to log in to the database via phpMyAdmin and check whether any suspicious users have appeared there who should not be. You should also reset all database passwords, as a person with access to our WordPress database can cause enormous damage and change the content of our site.

    Restore Photos and Other Files

    After you have finished checking the files, you can restore your photos and other site files.

    However, be careful and review the directories one by one before restoring the files. While there is little danger of infecting the site with multimedia files, any JavaScript or PHP file should immediately raise a red flag, as they most likely contain malware. These files should not be in your photo folders.

    Checking the Database Backup

    Operations on database files are very complicated, and a person without extensive knowledge of how MySQL, PostgreSQL, or MariaDB works will likely do more harm than good. Therefore, if you suspect your WordPress database is infected with malware, it is best to contact a company that handles this professionally.

    Summary

    Prevention is better than cure. Therefore, if you do not yet have a plugin installed to improve WordPress security, it is high time to download and install one.

    Furthermore, it is worth using suitably strong and long passwords to make it harder for hackers to crack them using the Brute Force method.

    Keep your WordPress core, themes, and plugins updated. The latest versions usually patch security vulnerabilities found in previous versions.

  • How to Run a CRON Job Every Hour in Linux and CyberPanel

    How to Run a CRON Job Every Hour in Linux and CyberPanel

    There are certain tasks on a computer that we need to perform regularly – for example, performing backups. In Linux, the Cron command is used for such repetitive tasks; it is invaluable for executing scheduled jobs. In this article, we will show you how to configure crontab to run a cron job every hour.

    What is cron?

    Cron is a tool, an application used for scheduling tasks, and running applications and scripts at a specific time in Unix-like operating systems. It allows you to schedule tasks (cyclically running applications or shell scripts) that will automatically run at a specified time and date. These tasks are called cron jobs.

    In Linux and Unix systems, cron is commonly used for maintenance or administrative tasks, such as running backups (with the option to later send them to an FTP server, for example) or sending automated emails. Cron can also be used, for instance, to check for system updates and many other things.

    Cron uses a configuration file called crontab. A crontab is a plain text file that can be edited with any text editor. The system administrator can configure a global crontab file with root permissions, and additionally, each user can have their own settings, limited by their user permissions.

    A cron job is usually executed in the background, and if there is any output, it can be sent to the user via email or saved to a file. Cron is a powerful tool that allows you to automate virtually any task, but it can be difficult for novice users to operate if they are not familiar with the required command syntax.

    What can we use cron for?

    With cron, we can manage virtually any function of a computer or server and run cyclical tasks at a specific time and date. We can use it for example to:

    • Automate repetitive tasks. A cron job can be used to automate tasks at regular intervals, such as running backups or sending cyclical emails, for example, with reminders.
    • Run system tasks on a schedule. A cron job can check for available updates for the operating system or applications, or for example, it can regularly clean the computer of temporary files and unnecessary system logs.
    • Automatically perform system updates, update security, and install new software. This can help to better secure the system and ensure that we always have the latest versions of applications and libraries installed on our computer or server.
    • Improve performance. Thanks to cron, we can configure the execution of tasks that heavily load the computer to run during hours when the computer is least used, for example, at night.

    Overall, cron can significantly streamline the performance of cyclical tasks through their automation.

    Create a cron job in the Linux terminal

    The crontab command is used to create cron jobs. To create a new cron job:

    1. Open a terminal window.
    2. Type the command crontab -e to open the cron configuration file.
    3. Add a new entry to the crontab file, remembering to maintain the correct format, otherwise the task will not run:minute hour day-of-month month day-of-week command-to-executeAn asterisk instead of minutes, hours, or months means that this task will run every hour, minute, or every month. For example, if we want a command or script to run on the hour (i.e., at minute 0) every day of every month, we must type:0 * * * * command-to-execute
    4. Save the crontab file and close it.
    5. Use the command crontab -l to display the list of saved cron jobs to be executed.

    NOTE: The syntax for cron job commands may vary depending on the version of the Linux system. We are basing this on the Ubuntu system. To learn more about the cron application, type man cron in the terminal.

    How to create a cron job in CyberPanel

    If your web server is based on LiteSpeed, you should install the CyberPanel overlay. Creating cron jobs in CyberPanel is much simpler and more pleasant than in a crontab file.

    1. Log in to your CyberPanel Dashboard.
    2. On the left side, click on Websites, then List Websites, select your website and click Manage.
    3. Scroll down and click on Cron Jobs.
    4. To add a new cron job, press ADD CRON. To see a list of existing jobs, click FETCH CURRENT CRON JOBS.
    image 18
    image 20
    image 21
    image 22

    To have a given task run weekly, select Every week from the list. In the example below, cron will run a previously written backup script every week, on Wednesday at 4:16 AM. In the Day of week window, we enter numbers from 0 to 7. 0 or 7 means Sunday, 1 Monday, 2 Tuesday, etc.

    We can also enter the days of the week by name in English: mon, tue, wed, thu, fri, sat, or sun.

    Press Add Cron to save the created task.

    Isn’t configuring cron in CyberPanel more pleasant?

  • Speed Up Your WordPress Site by Reducing Unused JavaScript

    Speed Up Your WordPress Site by Reducing Unused JavaScript

    In this article, you will learn how to remove unused JavaScript from your site, which will help to speed up its loading time. The issue is that a significant portion of JavaScript code is not utilised on the page and slows it down unnecessarily, as the more code on a page, the longer it takes to load. And nobody likes a slow-running website. Therefore, it is crucial to be able to locate and remove unnecessary JavaScript from your website.

    What is JavaScript?

    JavaScript is a programming language that allows, among other things, for the creation of dynamically updated content and the management of multimedia, and much, much more. It’s incredible how many effects can be achieved with just a few lines of JavaScript code.

    Through the Document Object Model (DOM) API, JavaScript is also used to dynamically edit HTML and CSS code to refresh content on web pages. When creating a page, remember that the website’s code typically loads and executes in the order it appears on the page. So, if JavaScript that uses HTML code is loaded and run before the HTML it needs has loaded, errors may occur on the page.

    What is Unused JavaScript?

    Unused JavaScript refers to resources that are not used or required for rendering and displaying the site’s content.

    Despite this code not being used, the user’s browser still has to load it into memory. There is no benefit from this; it only slows down the page loading and burdens the user’s computer memory.

    Why is it Worth Removing Unused JavaScript?

    Loading unnecessary JavaScript can have a significant negative impact on site performance and the overall user experience. The “First Contentful Paint” (FCP) parameter, one of the main indicators in Google PageSpeed Insights that assesses user experience, is heavily influenced by JavaScript code.

    Types of Unnecessary JavaScript Code

    Let’s divide unused JavaScript code into two categories:

    • Non-critical JavaScript: This is used elsewhere on the site but does not need to be loaded first and block the loading of other site elements. Such code blocking the site’s loading worsens our FCP parameter.
    • Dead JavaScript: This is not used at all on the page and can be safely removed.

    Disadvantages of Loading Unused JavaScript Code

    Unused JavaScript has a negative impact on website performance and delays page loading. Our site’s position in Google search results depends, among other things, on its speed. This is one of the key parameters. Furthermore, the likelihood that users will leave our website and visit another increases if our site runs slowly. This affects the bounce rate, which is extremely important for SEO and causes Google to lower our site’s search rankings.

    It is important to distinguish between two different things: the actual loading time of the site is not the same as how users perceive its loading time. The most important thing for the user is to see the first elements at the top of the page as quickly as possible and for them to be responsive. The rest of the page elements below can load later; it is important that the user sees a blank page for the shortest possible time.

    Advantages of Removing Unused JavaScript Code

    It is obvious that the more JavaScript, HTML, or CSS the browser has to download and execute, the longer the page takes to load. It doesn’t matter whether the JavaScript code is needed or not; if it is on the page, the browser will always download and run it.

    This is especially important for mobile users on smartphones. Not only does unnecessary code use up our data allowance, but mobile devices are also not as powerful as desktop computers. To speed up your site’s loading, you should be able to find and remove unused JavaScript, or at least make it load later so it doesn’t block the initial stages of page loading.

    How to Reduce the Amount of Unused JavaScript?

    First, we will try to find large JavaScript files using GTMetrix, and then I will show you ways to remove the unwanted code.

    Use GTMetrix to Find Large JavaScript Files

    Go to the GTMetrix website and enter your website address in the appropriate field.

    Click on the Waterfall tab.

    image 2

    Below, click on the JS tab, and you will see the JavaScript files. Click on Size to sort them from largest to smallest.

    image 4

    JavaScript Minification

    JavaScript minification involves removing unnecessary code from the script.

    NOTE: Improper code minification can damage your site. Before using this guide, be sure to make a full backup of your entire site, including the database.

    Removing Unnecessary JavaScript Code with the LiteSpeed Cache Plugin.

    If your site runs on a LiteSpeed or OpenLiteSpeed web server, you can use the LiteSpeed Cache plugin to minify JavaScript code. If you also use the CyberPanel, this plugin is installed by default.

    1. Go to your WordPress Dashboard and click on LiteSpeed Cache.
    2. Click on Page Optimization.
    3. Click on JS Settings at the top, and then enable JS Minify.
    4. Click Save Changes.
    image 5
    image 6

    Removing Unwanted JavaScript Code in Elementor

    If you use the Elementor plugin, you can remove unwanted JavaScript code with it.

    1. Go to the WordPress Dashboard, click on Elementor on the left, and then on Settings.
    2. Click the Experiments tab at the top.
    3. Scroll down to the Stable Features section and enable the Improved Asset Loading option.
    4. Go to the very bottom of the page and click Save Changes.
    image 7
    image 8
    image 9

    Delaying the Loading of Necessary but Non-Critical JavaScript with Async JavaScript

    1. Go to your WordPress Dashboard and install the Async JavaScript plugin if you don’t have it.
    2. Click on Settings, then Async JavaScript.
    3. Click on the Settings tab at the top, then click the Apply Defer button.
    4. Go to the very bottom of the page and click Save Settings.
    image 10
    image 11
    image 12

    Removing Unused Code with the Asset CleanUp Plugin

    When certain files or plugins do not need to be loaded on a specific subpage of our site, we can disable them using the Asset CleanUp: Page Speed Booster plugin. This plugin is a powerful tool, but in inexperienced hands, it can cause damage to our site. Remember to make a backup of your site before editing it.

    1. Install Asset CleanUp if you do not already have this plugin.
    2. Go to the WordPress Dashboard, then click on Asset CleanUp and Settings on the left.
    3. Click the Test Mode tab on the left and enable the Test Mode function. This is a very useful feature. When enabled, only logged-in administrators will see the changes made. If it turns out during testing that our site is not working correctly, only administrators will see it, and the pages will still work correctly for normal users of our site. Only after making sure that everything is working correctly can we disable the Test Mode, and from then on, the site will load faster without the unnecessary JavaScript code.
    4. After making changes, scroll down the page and click Update All Settings.
    5. On the left, click the Optimize JavaScript tab.
    6. Enable the option Combine loaded JS (JavaScript) into fewer files.
    7. Scroll to the bottom of the page and click Update All Settings to save the settings.
    image 13
    image 14
    image 15
    image 16
    image 17

    Summary

    Loading unnecessary JavaScript code makes a site load more slowly because the user’s browser has to download, parse, compile, and execute it needlessly. Unused code consumes mobile data allowance and slows down page rendering. All of this worsens the user experience and lowers our site’s ranking in Google search results.

    By minifying JavaScript and removing unnecessary code, you will speed up your site’s loading time and improve its overall functionality.