Advanced Commands

Fill in any of the fields below to auto-populate the sentinel strings in the commands. Leave a field blank to keep the sentinel and swap it manually in your terminal.

Generate WHM root session on Core/Root cPanel server.

See current disk usage for home directory.

Add hostname SSL if hostname A record active.

Check all user's cronjobs. Useful for finding perl spam cronjobs.

See current memory usage dump.

See current memory usage nice.

See current CPU usage dump.

See Sar memory usage for today.

See Sar memory usage for yesterday.

See Sar top hits for today.

See Sar top hits for yesterday.

See top usage for today.

See top usage for yesterday.

Check /var/log/messages for today.

Check /var/log/messages for yesterday.

Check /var/log/messages for last 20 oom, error, critical, and kill errors.

Check /var/log/messages for oom, error, critical, and kill errors for today.

Check /var/log/messages for oom, error, critical, and kill errors for yesterday.

Check /var/log/messages for oom, error, critical, and kill errors.

Check rotated /var/log/messages for oom, error, critical, and kill errors.

Some commands below contain sentinel strings like Username_not_provided_in_form, Domain_not_provided_in_form, Email_not_provided_in_form, and ClientIP_not_provided_in_form. Fill in the form above to auto-substitute these; leaving a field blank keeps its sentinel so you can swap it manually in your terminal. Two commands (cruft_check_user_or_domain, force_license_check_verify) always show sentinel strings by design — they use them as defensive fallback signals and work whether or not you filled the form.

Check VPS/Dedicated host information.

See domain count on cPanel server.

Add default reseller privileges to all accounts.

Find all sites with dedicated IPs on cPanel server.

Install Memcached and PHP memcache(d) extensions on Ubuntu cPanel (EA-PHP 7.x/8.x, configures daemon for 127.0.0.1, 64MB)

Restore a cPanel full backup, skipping the account-creation step (pass full path to .tar.gz, e.g. /home/cpmove-USERNAME.tar.gz)

Generate a full backup for a cPanel user (system writes the .tar.gz into /home/USERNAME/)

Back up every account owned by a reseller into the reseller's home directory

Restore every .tar.gz backup found in /home/ (logs results to /root/restore-status.txt)

List .tar.gz backup files in /home/

Show current EA4 PHP handlers and the default PHP version (via /usr/local/cpanel/bin/rebuild_phpconf --current)

List a cPanel user's PostgreSQL databases via cpapi2 (clean output)

Enable SSH for a cPanel user via whmapi1 (HASSHELL=1)

Enable and monitor the postgresql service via whmapi1

Get the PHP version currently set for a domain via whmapi1

Set the PHP version for a domain via whmapi1 (defaults to ea-php72 in the command — edit before running)

Check the Redis daemon status and the redis PHP extension across all EA-PHP versions

Install Redis from EPEL plus the redis PHP pecl extension for all EA-PHP versions (sets maxmemory=512MB, allkeys-lru policy)

List the current cPanel user's MySQL databases via uapi (clean output)

Export Mailman mailing-list subscribers to the user's home directory (takes user and the mailing-list email address)

Run a cPanel userdata cruft check by username OR domain (uses whichever field was provided in the form)

Run the upstream CpanelInc tech-cp_license_troubleshooter

Show ionCube/Zend Loader status across all EA-PHP versions (info shown in each php -v output)

List every email account belonging to a reseller's cPanel users (derived from on-disk folder structure)

Force a cPanel license check via verify.cpanel.net (uses Client IP from the form, or the server's own IP if blank)

Count cPanel accounts on the server (useful for license-tier sizing)

Set up a domain catchall/forwarder to a specific email address (writes /etc/valiases/DOMAIN)

Fix PostgreSQL failed-to-start by symlinking postgresql-9.6.service to the generic postgresql.service unit

Refresh the Softaculous license via cli.php --refresh-license

Install the PHP Timezone DB pecl extension across all EA-PHP versions (commonly needed for LiteSpeed)

Find AND delete all expired cPanel SSL certificates via whmapi1

Find (without deleting) expired cPanel SSL certificates via whmapi1

Set every reseller-owned domain's SOA serial to today's date (backs up /var/named first — fixes post-migration zone issues)

List a cPanel account's unique vhosts via uapi (main domain + addons + subdomains)

Check a domain's catchall configuration (cat /etc/valiases/DOMAIN)

Check cPHulkd status via whmapi1 + ps grep

Check for the DSO conflict on MultiPHP installations (looks for ea-php70-php.x86_64)

Enable HTTP Authorization for an Apache user's vhost (fixes missing Authorization headers under Apache + PHP)

Reinstall Softaculous via the upstream install.sh --reinstall

Find cPHulkd-blacklisted IPs from the log (unique + whois lookup)

Fully disable cPHulkd (service + init + PAM + iptables rules + sqlite hulkd.db)

Find today's cPHulkd-blacklisted IPs from the log (handles both Mon DD and YYYY-MM-DD log-line date formats)

Update the cPanel Cloudflare plugin via cloudflare_update.sh -f

Find every reference to a user or domain hidden across cPanel files (/etc, /var/cpanel/users, /var/cpanel/userdata, valiases)

Force-reinstall all cPanel files (upcp --force), even if the system is up to date

Re-sync the currently installed cPanel version's files (upcp --sync) — no version change, just file integrity

Fix EA-PHP settings (memory_limit, max_execution_time, session.save_path, etc.) across all PHP versions via whmapi1

Check NS records in every /var/named zone file (excludes TXT and comments)

Increment every /var/named zone serial to today's date + hour

Install Mcrypt via pecl for PHP 7.2+ on cPanel (installs libmcrypt + libmcrypt-devel from EPEL first)

Remove chattr +i from Softaculous universal.php (for debugging)

Re-add chattr +i to Softaculous universal.php (after debugging)

Check Softaculous PHP settings (max_execution_time, memory_limit) across cPanel's 3rdparty PHP versions and the system php.ini

Check which of memcache/memcached/imagick/mcrypt are loaded in each EA-PHP version

Install ImageMagick + the imagick pecl extension across all EA-PHP versions on CentOS/RHEL cPanel (restarts httpd at the end)

Install Memcached and PHP memcache(d) extensions on CentOS/RHEL cPanel from the EA4-experimental repo (PHP 5.x/7.x/8.x)

Run AutoSSL across every cPanel user under a reseller

Tail a user's Softaculous logs (softaculous.log + error_log.log) for user-level debugging

Disable WHM 2-factor auth from CLI as root (use when locked out of WHM)

Disable and uninstall PHP-FPM (removes ea-php*-php-fpm rpms and backs up default_accounts_to_fpm)

Enable the WHM in-browser SSH terminal (removes the disable_whm_terminal_ui flag)

Switch cPanel's nameserver to PowerDNS (fixes Named-down conditions due to deprecated NSD/NAMED)

Fix default cPanel PHP memory_limit and session.save_path across all versions via whmapi1 (requires root)

Check the memcache/memcached PHP extension across all EA-PHP versions AND the memcached service process status

Rebuild userdata cache + userdomains + httpd.conf, then restart httpd

Check the cpbackup main log (excludes 'Waiting' and 'Checking' noise lines)

Find Success-marked entries in the cpbackup logs

Manually start a cPanel backup (--force)

Force cPanel to recheck its license now (cpkeyclt --force)

Show installed cPanel version (/usr/local/cpanel/cpanel -V)

Show only NS1/NS2 from /etc/wwwacct.conf (filters out NS3/NS4/NSTTL; cleaner than the broader host_information above)

Add a hostname SSL if the hostname A record is active (uses checkallsslcerts)

Show memory_limit, post_max_size, upload_max_filesize, max_execution_time, and session settings across all EA-PHP versions (does not require root)

Grep memory_limit out of every EA-PHP php.ini file (skips commented lines)

Generate a one-time WHM root login URL on this server (whmlogin)

Restore a cPanel user's MySQL grants from the latest backup (--db=mysql --all)

Fix reseller permissions for a specific reseller (common fix for 'Missing myprivs' WHM API errors)

Install DKIM keys for a cPanel user

Remove/uninstall DKIM keys for a cPanel user

Fix horde/roundcube sqlite database errors for a cPanel user (update_horde_config --full)

Find a cPanel user's unique IPs from login/session/access/secure/messages logs, then whois each one

Fetch a cPanel user's login/session/activity logs for audit (downloader script from wizardassistant.app)

Find every cPanel user under a reseller, then list each user's domains

Find a cPanel user's domains via /etc/userdomains

Find which cPanel user owns an addon domain

Find when a domain was created or terminated in /var/cpanel/accounting.log

Find when a cPanel user was created or terminated in /var/cpanel/accounting.log

Find a cPanel user's mailbox format (MAILBOX_FORMAT in /var/cpanel/users/USER)

Reset CageFS for all users.

LveStats for all users by faults for 1 day.

See current connections by IP.

See current connection count by port.

See open listening ports.

Web traffic for ports 80|443 connections by IP.

Email traffic for ports 25|465|995|993 connections by IP.

Check for xmlrpc attack from today's logs.

Find all IPs bound to server.

FirewallD status.

FirewallD add port.

FirewallD reload.

Check "ips" file against iptables for FirewallD blocks.

Check firewall ports for APF.

Check firewall ports for CSF.

Check "ips" file against CSF.

Check for CSF remote SMTP_BLOCK.

See Dovecot connection count.

Check for Dovecot process_limit being hit.

See current Dovecot connections by cPanel user.

See Dovecot connection count by port.

Sort Exim queue by email address.

Command to search for all external logins.

Find which user/account is sending the most mail — possibly hacked account.

Check for the X-PHP-Script field.

Find the top scripts sending mail.

Top mailing script locations in the Exim mail log.

Exim clear frozen queue (method 1).

Exim clear frozen queue (method 2).

Exim clear frozen queue (method 3).

cPanel/Exim finding current connections count.

cPanel/Exim finding current connections count IPs.

cPanel/Exim finding refused connections from today.

cPanel/Exim finding refused connections from yesterday.

cPanel/Exim finding top refused connections in current exim_mainlog.

cPanel/Exim finding too many connections with whois lookup from today.

cPanel/Exim finding too many connections with whois lookup from yesterday.

cPanel/Exim finding too many connections in current exim_mainlog with whois lookup.

Find Apache Max errors. Useful for finding Max retries, max request client errors.

Check for MaxClients or MaxRequestWorker notifications in the Apache error logs with sort.

Tail Apache errors live.

Check Apache error logs for today.

Check Apache error logs for yesterday.

Check Apache error logs for last 20 errors from today.

Check Apache error logs for last 20 errors from yesterday.

Tail Apache stderr.log live. Good for finding errors not in standard Apache error log.

Check Apache stderr.log last 10. Good for finding errors not in standard Apache error log.

Check for Litespeed lsrestart.log for last 20.

Check for Apache safeapacherestart.log for last 20.

Apache rebuild userdata cache and rebuild conf and restart.

Linux find MySQL error log.

Tail MySQL error log.

Search MySQL error log last 20.

Search MySQL error log by today's date.

Search MySQL error log by today's date last 20.

Search MySQL error log by yesterday's date.

See MySQL uptime.

See MySQL connection count.

See MySQL connections.

Fix MySQL is not running, but lock file (/var/lock/subsys/mysql) exists.

See MySQL /etc/my.cnf.

Check memcached status on server.

RAISE USER'S PHP VALUES IN LOCAL INI FILES

FIND HIDDEN REDIRECTS CURL

LITESPEED KILL SERVER DETACHED PHP PROCESSES

LITESPEED RESTART USER'S DETACHED PHP AS USER

LITESPEED RESTART SERVERS DETACHED PHP

SHOW HARDCODED PHP ERRORS DISABLED

FIND PHP HANDLER SETTINGS SERVER

FIND PHPHANDLER SETTINGS SEREVER

LITESPEED/OPENLITESPEED VERSION

DISABLE BAD PHP HANDLERS INI

FIND PHP HANDLER SETTINGS USER

FIND PHPHANDLER FILE NAME USER

CPANEL UPDATES LITESPEED CONFIG HANDERLS

CPANEL REBUILD HTTP CONF

RESET LITESPEED ADMIN PASSWORD

LITESPEED FORCE UPDATE

CHECK APACHE CONF MAX WORKERS