Quick Fix Security Commands & One-Liners

By FixTheVuln Team Peer-reviewed security content Sources: CISA, NVD, OWASP

⚠️ Warning: Always test commands in a staging environment first. Back up your data before applying fixes to production systems.

System Updates & Patching

Update All Packages (Linux)

                    # Ubuntu/Debian
sudo apt update && sudo apt upgrade -y && sudo apt autoremove -y

# CentOS/RHEL/Fedora
sudo yum update -y && sudo yum autoremove -y

# Arch Linux
sudo pacman -Syu

# Alpine Linux
sudo apk update && sudo apk upgrade
                

Update Specific Vulnerable Package

                    # Ubuntu/Debian
sudo apt install --only-upgrade package_name

# CentOS/RHEL
sudo yum update package_name

# Check version after update
package_name --version
                

Windows Updates (PowerShell)

                    # Install Windows Update module
Install-Module PSWindowsUpdate -Force

# Check for updates
Get-WindowsUpdate

# Install all updates
Install-WindowsUpdate -AcceptAll -AutoReboot
                

Web Application Security

Fix File Permissions (Linux)

                    # Secure web directory permissions
sudo find /var/www/html -type d -exec chmod 755 {} \;
sudo find /var/www/html -type f -exec chmod 644 {} \;

# Secure WordPress
sudo chown -R www-data:www-data /var/www/html/wordpress
sudo find /var/www/html/wordpress -type d -exec chmod 755 {} \;
sudo find /var/www/html/wordpress -type f -exec chmod 644 {} \;

# Make wp-config.php read-only
sudo chmod 400 /var/www/html/wordpress/wp-config.php
                

Remove Default/Test Files

                    # Remove common default files
sudo rm -f /var/www/html/index.html
sudo rm -f /var/www/html/phpinfo.php
sudo rm -rf /var/www/html/test
sudo rm -rf /var/www/html/backup

# Remove Apache default pages
sudo rm -f /etc/apache2/sites-enabled/000-default.conf

# Remove Nginx default config
sudo rm -f /etc/nginx/sites-enabled/default
                

Disable Directory Listing

                    # Apache (.htaccess)
Options -Indexes

# Nginx (in server block)
autoindex off;
                

Database Security

MySQL Secure Installation

                    # Run MySQL secure installation script
sudo mysql_secure_installation

# Or manually:
mysql -u root -p << EOF
DELETE FROM mysql.user WHERE User='';
DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');
DROP DATABASE IF EXISTS test;
DELETE FROM mysql.db WHERE Db='test' OR Db='test\\_%';
FLUSH PRIVILEGES;
EOF
                

Change Database Root Password

                    # MySQL
ALTER USER 'root'@'localhost' IDENTIFIED BY 'NewStrongP@ssw0rd!';
FLUSH PRIVILEGES;

# PostgreSQL
ALTER USER postgres WITH PASSWORD 'NewStrongP@ssw0rd!';

# MongoDB
use admin
db.changeUserPassword("admin", "NewStrongP@ssw0rd!")
                

SSH Hardening

Quick SSH Security Fixes

                    # Backup original config
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup

# Apply secure settings (one-liner)
sudo sed -i 's/#PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config && \
sudo sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config && \
sudo sed -i 's/#PermitEmptyPasswords no/PermitEmptyPasswords no/' /etc/ssh/sshd_config && \
sudo systemctl restart sshd

# Or using echo to append
echo "PermitRootLogin no" | sudo tee -a /etc/ssh/sshd_config
echo "PasswordAuthentication no" | sudo tee -a /etc/ssh/sshd_config
sudo systemctl restart sshd
                

Generate Strong SSH Key

# Generate ED25519 key (recommended)
ssh-keygen -t ed25519 -C "[email protected]"

# Or RSA 4096-bit
ssh-keygen -t rsa -b 4096 -C "[email protected]"

# Copy to server
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server

Firewall Quick Fixes

Enable and Configure UFW

                    # Quick secure firewall setup
sudo ufw default deny incoming && \
sudo ufw default allow outgoing && \
sudo ufw allow 22/tcp && \
sudo ufw allow 80/tcp && \
sudo ufw allow 443/tcp && \
sudo ufw --force enable

# Check status
sudo ufw status verbose
                

Block Specific IP

                    # UFW
sudo ufw deny from 192.168.1.100

# iptables
sudo iptables -A INPUT -s 192.168.1.100 -j DROP

# Block IP range
sudo ufw deny from 192.168.1.0/24
                

SSL/TLS Fixes

Install Let's Encrypt Certificate

                    # Install Certbot
sudo apt install certbot python3-certbot-apache -y

# Get certificate (Apache)
sudo certbot --apache -d example.com -d www.example.com

# Get certificate (Nginx)
sudo apt install certbot python3-certbot-nginx -y
sudo certbot --nginx -d example.com -d www.example.com

# Auto-renewal (add to crontab)
0 0 * * * certbot renew --quiet
                

Disable Weak SSL/TLS Protocols

                    # Apache (in ssl.conf or virtualhost)
SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite HIGH:!aNULL:!MD5:!3DES

# Nginx (in server block)
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384';
ssl_prefer_server_ciphers on;
                

Malware & Backdoor Detection

Find Recently Modified Files

                    # Files modified in last 7 days
find /var/www/html -type f -mtime -7 -ls

# Files modified today
find /var/www/html -type f -mtime 0

# Find suspicious PHP files
find /var/www/html -name "*.php" -type f -exec grep -l "eval(" {} \;
find /var/www/html -name "*.php" -type f -exec grep -l "base64_decode" {} \;
                

Scan for Malware

                    # Install ClamAV
sudo apt install clamav clamav-daemon -y

# Update virus definitions
sudo freshclam

# Scan directory
sudo clamscan -r /var/www/html

# Scan and remove infected files
sudo clamscan -r --remove /var/www/html
                

🛡️ Pro-Level Malware Protection

For advanced threat detection beyond command-line tools, use industry-leading protection:

Get Malwarebytes Premium

Detects threats traditional antivirus misses • Real-time protection • Trusted by security professionals

WordPress Specific Fixes

Update WordPress Core & Plugins

                    # Using WP-CLI
wp core update
wp plugin update --all
wp theme update --all

# Check for vulnerabilities
wp plugin list --status=active
wp theme list --status=active
                

Disable XML-RPC

                    # Add to .htaccess
<Files xmlrpc.php>
    Order Deny,Allow
    Deny from all
</Files>

# Or in Nginx
location = /xmlrpc.php {
    deny all;
}
                

Protect wp-config.php

                    # Add to .htaccess
<files wp-config.php>
    Order deny,allow
    Deny from all
</files>

# Or move outside web root
mv wp-config.php ../
# WordPress will automatically find it one directory up
                

Log Analysis & Monitoring

Check for Failed Login Attempts

                    # SSH failed logins
sudo grep "Failed password" /var/log/auth.log | tail -20

# Count failed attempts by IP
sudo grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -nr

# Apache access log - 401/403 errors
sudo grep " 40[13] " /var/log/apache2/access.log | tail -20

# Nginx access log
sudo grep " 40[13] " /var/log/nginx/access.log | tail -20
                

Install Fail2Ban (Brute Force Protection)

                    # Install
sudo apt install fail2ban -y

# Copy default config
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

# Enable SSH protection
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

# Check status
sudo fail2ban-client status
sudo fail2ban-client status sshd
                

Docker Security

Update Docker Images

                    # Pull latest versions of all images
docker images --format "{{.Repository}}:{{.Tag}}" | grep -v "" | xargs -L1 docker pull

# Remove old/dangling images
docker image prune -a

# Update running containers
docker-compose pull && docker-compose up -d
                

Scan Docker Images for Vulnerabilities

                    # Using Trivy
docker run aquasec/trivy image your-image:tag

# Using Snyk
snyk container test your-image:tag
                

Node.js / npm Security

Fix npm Vulnerabilities

                    # Audit packages
npm audit

# Fix automatically
npm audit fix

# Force fix (may break things)
npm audit fix --force

# Update all packages
npm update

# Check for outdated packages
npm outdated
                

Emergency Response

Quick Site Takedown (If Compromised)

                    # Apache - Stop service immediately
sudo systemctl stop apache2

# Nginx - Stop service
sudo systemctl stop nginx

# Put up maintenance page
echo "Site under maintenance" | sudo tee /var/www/html/index.html

# Block all incoming traffic (emergency)
sudo iptables -P INPUT DROP
sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
                

Pro Tip: Create a security checklist script with these commands for regular security maintenance. Run it weekly or monthly depending on your risk profile.

Related Resources

OWASP Top 10 Security Headers SSL/TLS Guide

Latest from the Blog

AWS Cloud Practitioner Study Guide: How to Pass the CLF-C02 Exam AWS Security Specialty Study Guide: How to Pass the SCS-C02 Exam AWS Solutions Architect Study Guide: How to Pass the SAA-C03 Exam

← Back to Tools

FixTheVuln Store

Get the CompTIA Security+ Study Planner

Fillable PDF study planners with domain trackers, weekly schedules, and progress tracking. Available in Standard, ADHD-Friendly, Dark Mode, and 4-Format Bundle.

CompTIA Security+ Planner

60+ certifications available — from $5.99

FixTheVuln Store

Patch Tuesday Sprint Kit

5 fillable templates for vulnerability triage, sprint planning, testing, SLA tracking, and executive reporting. Free blank templates or $4.99/mo for pre-filled intelligence with real CISA KEV data.

Try Free Templates Subscribe — $4.99/mo

FixTheVuln Store

Patch Tuesday Sprint Kit

5 fillable templates for vulnerability triage, sprint planning, testing, SLA tracking, and executive reporting. Free blank templates or $4.99/mo for pre-filled intelligence with real CISA KEV data.

Try Free Templates Subscribe — $4.99/mo

FixTheVuln Store

Patch Tuesday Sprint Kit

5 fillable templates for vulnerability triage, sprint planning, testing, SLA tracking, and executive reporting. Free blank templates or $4.99/mo for pre-filled intelligence with real CISA KEV data.

Try Free Templates Subscribe — $4.99/mo

CyberFolio

Choosing your next cert? Track them all in one place.

Build a shareable cybersecurity portfolio that highlights your certifications, projects, and skills — free.

Build Your Portfolio →

FixTheVuln Store

Patch Tuesday Sprint Kit

5 fillable templates for vulnerability triage, sprint planning, testing, SLA tracking, and executive reporting. Free blank templates or $4.99/mo for pre-filled intelligence with real CISA KEV data.

Try Free Templates Subscribe — $4.99/mo

FixTheVuln Store

Patch Tuesday Sprint Kit

5 fillable templates for vulnerability triage, sprint planning, testing, SLA tracking, and executive reporting. Free blank templates or $4.99/mo for pre-filled intelligence with real CISA KEV data.

Try Free Templates Subscribe — $4.99/mo

FixTheVuln Store

Patch Tuesday Sprint Kit

5 fillable templates for vulnerability triage, sprint planning, testing, SLA tracking, and executive reporting. Free blank templates or $4.99/mo for pre-filled intelligence with real CISA KEV data.

Try Free Templates Subscribe — $4.99/mo