We use essential cookies to run this site and, with your consent, analytics and advertising cookies. See the Cookie Policy and Privacy Policy.
A server with every port open exposes services you may not know are running. UFW (Uncomplicated Firewall) is a simple front end to the Linux packet filter that lets only the traffic you choose reach the machine.
sudo accesssudo apt update sudo apt install -y ufw sudo ufw default deny incoming sudo ufw default allow outgoing
Always allow SSH first or you will lock yourself out of a remote server. The limit rule also blocks addresses that open too many connections in a short time.
sudo ufw limit 22/tcp
sudo ufw allow 80/tcp sudo ufw allow 443/tcp
To restrict a service to a trusted network, add a source, for example sudo ufw allow from 203.0.113.0/24 to any port 5432 proto tcp. That range is a documentation example; use your own.
sudo ufw logging low sudo ufw enable sudo ufw status numbered
sudo ufw status numbered sudo ufw delete 3
Replace 3 with the number of the rule in your own list. Blocked connections are recorded in /var/log/ufw.log.
127.0.0.1 unless a port must be public.The server now drops unsolicited inbound traffic except SSH, HTTP and HTTPS. Review the rule list after every new service, remove unused rules, check the log periodically and keep packages patched with sudo apt upgrade.
Containers make deployments repeatable, but default settings expose more than necessary. This guide serves a static site with Nginx using Docker Compose, with read-only content, a localhost-only port, health monitoring and automatic restarts.
docker group, or sudodocker --version and docker compose versionmkdir -p ~/webapp/site cd ~/webapp cat > site/index.html <<'EOF' <!DOCTYPE html> <html lang="en"><head><meta charset="utf-8"><title>Hello</title></head> <body><h1>Served by Nginx in Docker</h1></body></html> EOF
services:
web:
image: nginx:1.27-alpine
ports:
- "127.0.0.1:8080:80"
volumes:
- ./site:/usr/share/nginx/html:ro
security_opt:
- no-new-privileges:true
healthcheck:
test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1/"]
interval: 30s
timeout: 5s
retries: 3
restart: unless-stopped
docker compose up -d docker compose ps curl -I http://127.0.0.1:8080
You should see HTTP/1.1 200 OK, and the service should report healthy after a short delay.
docker compose logs --tail 50 web docker compose pull docker compose up -d
You have a reproducible web container that is not directly reachable from the internet. Update pinned image versions regularly, scan images for known vulnerabilities, remove unused images with docker image prune and put TLS termination in front of the service.
Backups that depend on someone remembering to run them eventually fail. This tutorial creates a nightly compressed backup with a checksum, automatic deletion of old archives and a scheduled run using a systemd timer.
sudo access/srv/data)/var/backups/data, and a plan to copy archives off the machineSave this as backup.sh in your current directory.
#!/usr/bin/env bash set -euo pipefail SRC="/srv/data" DEST="/var/backups/data" KEEP_DAYS=14 STAMP="$(date +%F_%H%M%S)" ARCHIVE="backup-$STAMP.tar.gz" mkdir -p "$DEST" tar -czf "$DEST/$ARCHIVE" -C "$SRC" . ( cd "$DEST" && sha256sum "$ARCHIVE" > "$ARCHIVE.sha256" ) find "$DEST" -type f -name 'backup-*' -mtime +"$KEEP_DAYS" -delete echo "Backup complete: $ARCHIVE"
sudo mkdir -p /srv/data sudo install -m 750 -o root -g root backup.sh /usr/local/bin/backup.sh sudo /usr/local/bin/backup.sh
Create /etc/systemd/system/backup.service:
[Unit] Description=Daily directory backup [Service] Type=oneshot ExecStart=/usr/local/bin/backup.sh
Create /etc/systemd/system/backup.timer:
[Unit] Description=Run the directory backup daily [Timer] OnCalendar=*-*-* 03:00:00 Persistent=true [Install] WantedBy=timers.target
sudo systemctl daemon-reload sudo systemctl enable --now backup.timer systemctl list-timers backup.timer
Persistent=true runs a missed backup after the machine was powered off.
cd /var/backups/data sudo sha256sum -c backup-*.tar.gz.sha256 mkdir -p /tmp/restore-test sudo tar -xzf "$(ls -1 backup-*.tar.gz | tail -n 1)" -C /tmp/restore-test ls /tmp/restore-test
You now have scheduled, checksummed backups with 14-day retention. Keep a second copy off-site, check journalctl -u backup.service after changes, repeat the restore test every few months and never keep the only copy on the same disk as the original data.
Large images and videos are the most common reason pages load slowly. This guide builds one Bash script that converts images to WebP, re-encodes videos for streaming and optionally uploads results to an Amazon S3 bucket with long-lived cache headers.
sudo access/srv/uploadssudo apt update sudo apt install -y ffmpeg imagemagick webp ffmpeg -version | head -n 1
Save as optimize.sh. Files already converted are skipped, so reruns are fast.
#!/usr/bin/env bash
set -euo pipefail
SRC="${1:?Usage: optimize.sh SOURCE_DIR OUTPUT_DIR}"
OUT="${2:?Usage: optimize.sh SOURCE_DIR OUTPUT_DIR}"
mkdir -p "$OUT"
find "$SRC" -type f \( -iname '*.jpg' -o -iname '*.jpeg' -o -iname '*.png' \) -print0 |
while IFS= read -r -d '' f; do
name="$(basename "${f%.*}")"
[ -f "$OUT/$name.webp" ] && continue
convert "$f" -auto-orient -strip -resize '1600x>' -quality 80 "$OUT/$name.webp"
done
find "$SRC" -type f \( -iname '*.mp4' -o -iname '*.mov' \) -print0 |
while IFS= read -r -d '' f; do
name="$(basename "${f%.*}")"
[ -f "$OUT/$name.mp4" ] && continue
ffmpeg -nostdin -loglevel error -i "$f" \
-c:v libx264 -crf 23 -preset medium -vf "scale='min(1280,iw)':-2" \
-c:a aac -b:a 128k -movflags +faststart "$OUT/$name.mp4"
done
echo "Optimization finished."
chmod 750 optimize.sh ./optimize.sh /srv/uploads /srv/optimized du -sh /srv/uploads /srv/optimized
aws s3 sync /srv/optimized s3://your-bucket-name/media/ \ --cache-control "public, max-age=31536000, immutable"
Replace your-bucket-name with your bucket. The one-year immutable header is only safe if a changed file always gets a new name, for example hero-v2.webp.
Add this line with crontab -e to run nightly at 02:00:
0 2 * * * /home/ubuntu/optimize.sh /srv/uploads /srv/optimized >> /tmp/optimize.log 2>&1
Adjust the script path to match your user's home directory.
Media is now compressed consistently and ready for a CDN. Keep original files, review the log weekly, keep names unique, and test visual quality on a few samples before bulk conversion.
Core Web Vitals measure real user experience: how fast the main content appears (LCP), how stable the layout is (CLS) and how quickly the page responds (INP). This guide applies low-risk fixes you can ship today.
npx lighthouse https://your-site.example --only-categories=performance --output=html --output-path=./before.html
Replace the address with your own site. Targets: LCP of 2.5 s or less, CLS of 0.1 or less, INP of 200 ms or less.
<link rel="preload" as="image" href="/img/hero.webp" fetchpriority="high"> <img src="/img/hero.webp" alt="Product overview" width="1200" height="630" fetchpriority="high">
<img src="/img/photo.webp" alt="Team at work" width="800" height="533" loading="lazy" decoding="async">
Never lazy-load the hero image; it would delay LCP.
Always set width and height on media and reserve space for embeds and ads.
.embed { aspect-ratio: 16 / 9; width: 100%; }
@font-face {
font-family: "Body";
src: url("/fonts/body.woff2") format("woff2");
font-display: swap;
}
<script src="/js/app.js" defer></script>
gzip on;
gzip_comp_level 5;
gzip_min_length 1024;
gzip_types text/plain text/css application/json application/javascript image/svg+xml;
location ~* \.(css|js|webp|woff2)$ {
expires 1y;
add_header Cache-Control "public, immutable";
}
sudo nginx -t sudo systemctl reload nginx
Use long caching only for files with versioned names such as app.3f2a1.js.
npx lighthouse https://your-site.example --only-categories=performance --output=html --output-path=./after.html
Prioritized hero media, reserved space, deferred scripts and compression address the most common causes of slow pages. Retest after each release and watch real-user data in Google Search Console.
Choosing antivirus software is confusing because marketing claims are hard to verify. This guide explains the main categories of protection and gives a repeatable checklist for comparing products with evidence instead of advertising.
| Category | Example | Strengths | Limitations |
|---|---|---|---|
| Built-in | Microsoft Defender | Pre-installed on Windows, updated through the OS, real-time protection, no extra cost | Fewer extras such as VPN; Windows only |
| Open source | ClamAV | Free and scriptable; well suited to scanning mail and uploads on Linux servers | On-demand scanner by default; limited desktop and real-time features |
| Commercial suite | McAfee Total Protection and McAfee+ plans | Cross-platform subscription (Windows, macOS, Android, iOS) bundling antivirus, firewall, password manager, VPN and identity or scam monitoring, depending on the plan | Features and device limits differ by plan; the renewal price can differ from the first-year price |
McAfee is a long-established vendor that sells protection as annual subscriptions, organized by number of devices and included extras. Plan names, features and prices change often, so read the current comparison on the official mcafee.com site and check:
McAfee is a trademark of its owner. mfsolve is independent and has no affiliation with, or payment from, any antivirus vendor.
Laboratories such as AV-TEST, AV-Comparatives and SE Labs publish regular results for protection, performance impact and false alarms, including for McAfee, Defender and other products. Scores change each round, so read the latest report for your operating system.
No single product is best for everyone. Match the category to your use case, confirm it with recent independent tests and keep it updated. Review your choice once a year, then use the next guide to verify that protection is actually working.
Installing antivirus is not enough. Protection can be switched off, out of date or blocked by another program without an obvious warning. These checks confirm that real-time protection is active, definitions are current and scans work.
sudoOpen PowerShell as administrator:
Get-MpComputerStatus | Select-Object AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated
AntivirusEnabled and RealTimeProtectionEnabled should be True. If a third-party product is installed, Defender may correctly report itself as passive.
Update-MpSignature Start-MpScan -ScanType QuickScan
If you use McAfee instead of Defender, confirm its status inside the McAfee app. Menu names vary between versions, but the checks are the same:
sudo apt update sudo apt install -y clamav clamav-daemon clamscan --version sudo systemctl stop clamav-freshclam sudo freshclam sudo systemctl enable --now clamav-freshclam
clamscan -r --infected "$HOME/Downloads"
The summary shows how many files were scanned and how many are infected.
The EICAR test file is a harmless file created by the European Institute for Computer Antivirus Research so you can confirm that a product reacts to a detection. Download it only from the official eicar.org site. A working product should block or quarantine it at once. Delete it afterwards and use it only on devices you own.
You can now confirm that real-time protection is on, definitions are current and scans complete. Repeat these checks monthly, review quarantine logs, keep your system and browser updated and maintain off-site backups as the final safety net.
mfsolve publishes practical, step-by-step guides for developers, system administrators and site owners. Our topics are Linux, cloud infrastructure, automation, web performance and defensive security, including safe antivirus information.
Questions or topic ideas? Contact us.
We welcome questions, corrections, topic suggestions and privacy or copyright requests. Choose a topic below; the form opens your email app with the message ready to send. We aim to reply within five business days.
mfsolve is an independent technical publication. We cannot provide individual technical support or remote assistance, and we will never ask for your passwords.
We do not require registration. We may collect technical data such as IP address, browser type, device type, pages viewed and referring page through server logs and analytics tools. If you email us, we receive what you choose to send. Your theme and cookie choices are stored in your browser only.
To operate and secure the site, understand which content is useful, respond to messages and display advertising where applicable.
Third-party vendors, including Google, may use cookies to serve ads based on prior visits to this or other websites. Google's use of advertising cookies enables it and its partners to serve ads based on your visit to this site and other sites. You can opt out of personalized advertising in Google Ads Settings. Where required by law, we ask for consent before using non-essential cookies.
Depending on where you live (for example under GDPR or similar laws), you may request access to, correction or deletion of your personal data, or object to its processing. Use the contact page.
We keep emails and logs only as long as needed and use reasonable measures to protect them. No internet transmission is completely secure. This site is not directed to children under 13.
Where GDPR or UK GDPR applies, we process data based on our legitimate interest in running and securing the site, on your consent for non-essential cookies, and to respond to your requests. You may withdraw consent at any time using the cookie settings, and you may complain to your local data protection authority. Data may be processed in countries other than your own by our hosting and service providers.
Residents of California and some other US states may have the right to know what personal information is collected, to request deletion or correction, and to opt out of the sale or sharing of personal information for targeted advertising. We do not sell personal information for money. To exercise these rights, contact us; we will not discriminate against you for doing so.
Articles may link to other sites, including vendor websites. Their privacy practices are their own, so review them separately.
We may update this policy and will change the date above when we do.
Cookies and similar storage are small pieces of data kept on your device.
| Type | Purpose | Required? |
|---|---|---|
| Essential / preferences | Remember your cookie choice and light or dark theme | Yes |
| Analytics | Understand aggregated traffic and popular pages | No, only with consent |
| Advertising | Serve and measure ads, including by Google and partners | No, only with consent where required |
The site itself stores two small items in your browser: cc (your cookie choice) and th (your light or dark theme). Neither contains personal information. Third-party advertising or analytics providers, if enabled, set their own cookies, which are governed by their policies.
You can accept or decline non-essential cookies in the banner, and delete or block cookies in your browser settings.
Articles are provided for general educational purposes "as is", without warranties. Test commands and configuration in a non-production environment first and keep backups. We are not liable for losses resulting from use of this information.
Site text is owned by mfsolve. You may quote short excerpts with attribution and a link. Code samples may be used in your own projects.
Product and company names are trademarks of their owners and are mentioned for information only. We are not responsible for third-party sites we link to.
Ads shown on this site are served by third parties and do not imply endorsement.
The content on mfsolve is for educational and informational purposes. It is not professional IT, security, legal or financial advice, and it is not a substitute for advice tailored to your environment.
Commands and configuration can change or delete data and may lock you out of systems. Test in a safe environment, read each command before running it, keep verified backups and follow your organization's policies. We make no guarantee that any guide is complete, current or suitable for your situation, and we are not liable for loss or damage resulting from its use.
No antivirus product or security measure provides complete protection. Descriptions of Microsoft Defender, ClamAV, McAfee and other products are general, may become outdated and are not endorsements. Check each vendor's official site and recent independent test reports before deciding.
All product and company names are trademarks of their respective owners. mfsolve is not affiliated with, sponsored by or endorsed by them.
We are not responsible for the content, accuracy or practices of external websites.
mfsolve may be supported by advertising. This page explains how that works.
Ads, where shown, are provided by third-party networks such as Google. They are clearly separated from article content, and advertisers cannot pay to change, review or approve our articles. Ad networks may use cookies as described in our Cookie Policy.
At the time of writing, articles contain no affiliate links. If we add any in the future, they will be labeled and this page will be updated.
Mentions of products such as McAfee, Microsoft Defender and ClamAV are editorial and are not paid placements. We receive no compensation from the vendors named.
You can manage personalized advertising in Google Ads Settings or change your choice on the Cookie Policy page.
Every guide is written to be practical and reproducible. Commands are written in full, prerequisites are listed at the start and each article ends with maintenance advice.
We publish only defensive and constructive content: system hardening, cloud and container setup, automation, performance and safe antivirus use. We do not publish content about hacking, malware creation, cracking or bypassing protections.
Editorial decisions are not influenced by advertisers or vendors. See the Advertising Disclosure.
If you find an error, contact us with the article title and details. Confirmed errors are corrected promptly.
Text and original code samples on mfsolve are protected by copyright. You may quote short excerpts with attribution and a link back to the article. Code samples may be used in your own projects.
We respect intellectual property and expect the same from our readers. If you believe material on this site infringes your copyright, send a notice through the contact page choosing the topic "Copyright / DMCA notice" and include:
We review notices promptly and remove or correct material where appropriate. This page is general information and not legal advice.