Frequently Asked Questions

Default: Centmin Mod installs Nginx 1.29.6 or newer Nginx mainline versions automatically — the same default across all branches (132.00stable, 140.00beta01, 141.00beta01). No configuration is needed.

Custom version on fresh install: To install a different Nginx version, set NGINX_VERSION='x.y.z' in /etc/centminmod/custom_config.inc before running the Centmin Mod installer.

Post-install upgrade/downgrade: Set NGINX_VERSION='x.y.z' in /etc/centminmod/custom_config.inc then run centmin.sh menu option 4. Menu option 4 is only for upgrading or downgrading Nginx after Centmin Mod is already installed. See Nginx Upgrade / Downgrade for full details.

Use centmin.sh menu option 21 (Data Management). Run the centmin command and select option 21.

Key tools:

• backups.sh — Full file and database backups (MariaBackup for hot backups + mysqldump for logical backups)
• tunnel-transfers.sh — Server-to-server migration via SSH tunnels
• keygen.sh — SSH key management for passwordless authentication
• awscli-get.sh — S3 storage upload/download profiles

CentOS 7 is end-of-life (EOL). OS migration requires a fresh Centmin Mod installation on a new server with the target OS, then migrating your data using menu option 21 backup/migration tools.

Branch versions:

• 132.00stable — CentOS 7, AlmaLinux 8/9, Rocky Linux 8/9
• 140.00beta01 — CentOS 7, AlmaLinux 8/9, Rocky Linux 8/9
• 141.00beta01 — Adds AlmaLinux 10, Rocky Linux 10 (EL10) support

Switch branches: cmupdate update-stable, cmupdate update-beta, cmupdate update-betanext. See OS Migration guide.

The main Nginx configuration file is at /usr/local/nginx/conf/nginx.conf — NOT /etc/nginx/nginx.conf.

Centmin Mod compiles Nginx from source and installs to /usr/local/nginx/. Per-domain vhost configs: /usr/local/nginx/conf/conf.d/yourdomain.com.conf.

See Configuration Files for the full path reference.

Use Cloudflare DNS API validation. Add to /etc/centminmod/custom_config.inc:

CF_DNSAPI='y'
CF_Token='your_cloudflare_api_token'
CF_Account_ID='your_cloudflare_account_id'

Then issue the certificate:

/usr/local/src/centminmod/addons/acmetool.sh issue yourdomain.com lived --dns dns_cf

See DNS Validation and Cloudflare SSL with Let's Encrypt.

Centmin Mod addons are shell scripts located at /usr/local/src/centminmod/addons/. Install and run addons by executing the specific addon script with its full path via SSH:

# Let's Encrypt SSL management addon
/usr/local/src/centminmod/addons/acmetool.sh issue domain.com lived

# Redis PHP extension addon
/usr/local/src/centminmod/addons/redis.sh install

# Golang addon
/usr/local/src/centminmod/addons/golang.sh install

# WP-CLI addon
/usr/local/src/centminmod/addons/wpcli.sh install

# OpenDKIM email signing addon
/usr/local/src/centminmod/addons/opendkim.sh

Some addons are also accessible via centmin.sh menu options (e.g., menu option 13 for Redis PHP extension). See the full Addons catalog for all available addon scripts.

Three methods to install PHP extensions in Centmin Mod:

1. PECL install — pecl install extension_name, then create a .ini file in /etc/centminmod/php.d/
2. phpize compile — Build from source using phpize, ./configure, make, make install
3. Menu option 5 rebuild — Set PHP_EXTRAOPTS in /etc/centminmod/custom_config.inc and rebuild PHP

Some extensions have dedicated addon scripts (e.g., addons/php72-mcrypt.sh). See PHP Extensions documentation.

The default PHP-FPM pool config is at /usr/local/etc/php-fpm.d/www.conf — NOT /etc/php-fpm.d/www.conf.

All vhosts share a single default [www] pool (listening on port 9000) via the php.conf include. Optional numbered pools (pool2–pool5) at /usr/local/nginx/conf/phpfpmd/ are disabled by default.

See PHP-FPM Pool Configuration.

Centmin Mod includes a disk space alert script at /etc/cron.daily/diskalert. Edit it to configure:

• Set EMAIL='you@example.com' with your email address
• Set DISKSPACE_ALERTPERCENTAGE='80' to configure the threshold percentage

The script runs daily via cron and sends an email when disk usage exceeds the threshold. For mobile push notifications, consider integrating with pushover.net.

For more details, see the forum discussion. Also see Troubleshooting — Disk Space Monitoring.

Centmin Mod SSH login runs checks (yum updates, Nginx version). Slow logins are often caused by IPv6 timeouts when the server tries to resolve IPv6 addresses. Fixes:

• Add net.ipv6.conf.all.disable_ipv6 = 1 to /etc/sysctl.conf and run sysctl -p
• Or set DISABLE_IPVSIX='y' in /etc/centminmod/custom_config.inc

Diagnose with: curl -Iv https://nginx.org/en/download.html — look for IPv6 connection delays.

For more details, see the forum discussion. Also see Troubleshooting — Slow SSH Logins.

1. Backup: mysqldump --all-databases > /home/mysqlbackup/alldatabases.sql
2. Stop MySQL: mysqlstop
3. Backup datadir: cp -a /var/lib/mysql/ /var/lib/mysql.orig
4. Wipe and rebuild: rm -rf /var/lib/mysql/* then mysql_install_db --user=mysql
5. Start MySQL: mysqlstart
6. Restore: mysql < /home/mysqlbackup/alldatabases.sql

For corrupted InnoDB, try innodb_force_recovery = 1 (or 2) in /etc/my.cnf under [mysqld].

For more details, see the forum discussion. Also see MariaDB — Reset MySQL Directory.

To debug PHP-FPM SIGSEGV Signal 11 crashes:

1. Set PHPDEBUGMODE='y' and AUTODETECPHP_OVERRIDE='y' in /etc/centminmod/custom_config.inc
2. Recompile PHP via centmin.sh menu option 5
3. Core dumps are saved at /tmp/core-*
4. Run gdb backtrace: gdb -q $(which php-fpm) /tmp/core-FILE -ex 'thread apply all bt full' -ex quit

To disable debug mode, set PHPDEBUGMODE='n' and recompile.

For more details, see the forum discussion. Also see Troubleshooting — PHP-FPM Debug Mode.

Manual PECL download and phpize compile:

1. cd /svr-setup && pecl download apcu
2. Extract, then phpize && ./configure --with-php-config=/usr/local/bin/php-config && make -j$(nproc) && make install
3. Create /etc/centminmod/php.d/apcu.ini with extension=apcu.so
4. Restart: fpmrestart. Verify: php --ri apcu

Note: APCu must be reinstalled after each PHP upgrade via menu option 5.

For more details, see the forum discussion. Also see PHP-FPM — APCu Installation.

Use the htpasswd.sh tool at /usr/local/src/centminmod/tools/htpasswd.sh:

1. Create credentials: htpasswd.sh create /usr/local/nginx/conf/htpasswd user1 pass1
2. Add auth_basic and auth_basic_user_file directives to the Nginx vhost location block
3. Test and restart: nginx -t && ngrestart

For more details, see the forum discussion. Also see Nginx — Password Protection.

The cminfo command (/usr/bin/cminfo) displays comprehensive system information including:

• Centmin Mod version and branch
• Nginx, PHP, and MariaDB versions
• Server specs (CPU, RAM, disk usage)
• Kernel info and OS version

Run via SSH: cminfo

For more details, see the forum discussion. Also see Command Shortcuts — cminfo.

The log_format main_json is already defined in the default /usr/local/nginx/conf/nginx.conf template — do NOT add it manually.

Simply add the access_log directive to your vhost config:

access_log /home/nginx/domains/domain.com/log/access_log.json main_json buffer=256k flush=5m;

Parse with jq (pre-installed): jq '.' access_log.json. Centmin Mod logrotate auto-handles JSON logs.

For more details, see the forum discussion. Also see Nginx — JSON Access Logging.

Add a login alert script to /root/.bashrc that sends an email on each SSH login:

• Set SSH_ALERTEMAIL='you@example.com' in the script
• Uses ipinfo.io for IP geolocation lookup
• Sends email via the mail command with login IP, hostname, and location details

For a complete setup guide with the full script, see the SSH Login Email Alerts documentation. For more details, see the forum discussion.

Two methods to add additional IPs:

• CentOS 6/7 alias method: Create alias interface files at /etc/sysconfig/network-scripts/ifcfg-eth0:0, ifcfg-eth0:1, etc.
• CentOS 7 IPADDRx method: Add IPADDR1, IPADDR2, etc. directly in the main ifcfg-eth0 file

Apply changes: service network restart

For more details, see the forum discussion.

Two methods to customize WordPress routines:

• wpsetup-custom.inc: Create /usr/local/src/centminmod/inc/wpsetup-custom.inc to customize menu option 22 WordPress installation routines
• mycmupdate: Create /usr/local/bin/mycmupdate with your preferred cmupdate flags and make it executable

For more details, see the forum discussion.

Vhost template files:

• inc/nginx_addvhost.inc — used by menu option 2 and menu option 22
• tools/nv.sh — used by the nv command shortcut

For more details, see the forum discussion. Also see Vhost — Template Customization.

Set BORINGSSL_SWITCH='y' in /etc/centminmod/custom_config.inc, run cmupdate, then centmin.sh menu option 4 to recompile Nginx. Requires Nginx 1.15.3+.

For more details, see the forum discussion. Also see Nginx — BoringSSL TLS 1.3.

The default PORTFLOOD = "21;tcp;5;300" in /etc/csf/csf.conf limits FTP to 5 connections per 300 seconds per IP. This can block legitimate uploads.

• Check: grep 'Port Flood' /var/log/messages
• Fix: Increase hit count (max 20): PORTFLOOD = "21;tcp;20;300"
• Backup first: csf --profile backup
• Restart: csf -ra

For more details, see the forum discussion. Also see CSF Firewall — Port Flood & FTP.

Enable separate PHP-FPM pools for per-vhost PHP settings:

1. Uncomment include=/usr/local/nginx/conf/phpfpmd/*.conf in /usr/local/etc/php-fpm.conf
2. Use pre-existing pool configs (e.g., phpfpm_pool5.conf on port 9005)
3. Create a custom Nginx vhost include referencing the pool port
4. Add php_admin_value directives in the pool config for per-site settings

For more details, see the forum discussion. Also see PHP-FPM — Per Vhost PHP.ini.

Use the backup-perm.sh tool at /home/nginx/domains/domain.com/tools/backup-perm.sh:

• Saves file ownership and permissions to a backup file
• Can restore permissions from the backup
• Set up a cronjob for regular automated backups
• Auto-fixes nginx user/group ownership when needed

For more details, see the forum discussion.

Set DMOTD_PHPCHECK='y' in /etc/centminmod/custom_config.inc to enable PHP and Nginx version update alerts on every SSH login. The notification appears as part of the SSH login MOTD (Message of the Day).

For more details, see the forum discussion. Also see Command Shortcuts — PHP Update Notifications.

Six-step process:

1. Copy SSL cert dir: cp -a /usr/local/nginx/conf/ssl/olddomain.com /usr/local/nginx/conf/ssl/newdomain.com
2. Copy vhost config: cp /usr/local/nginx/conf/conf.d/olddomain.com.ssl.conf /usr/local/nginx/conf/conf.d/newdomain.com.ssl.conf
3. Replace domain: sed -i 's/olddomain.com/newdomain.com/g' /usr/local/nginx/conf/conf.d/newdomain.com.ssl.conf
4. Copy web root: cp -a /home/nginx/domains/olddomain.com/ /home/nginx/domains/newdomain.com/
5. Clean up old config (optional)
6. Reissue SSL: acmetool.sh reissue-only newdomain.com live

For more details, see the forum discussion. Also see Vhost — Domain Rename.

Yes. You can host unlimited websites on one Centmin Mod server. Run /usr/bin/nv once per domain — each domain gets its own Nginx vhost configuration at /usr/local/nginx/conf/conf.d/ and document root at /home/nginx/domains/.

# Add each website with its own nv command
/usr/bin/nv -d site1.com -s lelived -u user1
/usr/bin/nv -d site2.com -s lelived -u user2

Always use -s lelived (Let’s Encrypt) for production sites. See the Hosting Multiple Websites guide for more details.

Yes — but the conflict depends on whether you’re referring to the server’s main hostname or a hosted site domain (vhostname). opendkim.sh handles these as two separate cases. Running it independently on both servers generates different private keys. Since DNS only holds one public key per DKIM selector (e.g., default2026._domainkey.yourdomain.com), one server’s signatures will fail verification.

Scenario 1 — Same server main hostname on both servers

This applies when both servers share the same FQDN (e.g., server.example.com), which opendkim.sh auto-detects via hostname -f. Running addons/opendkim.sh without arguments triggers this path.

Option A — Share the same DKIM private key (recommended for standby/failover clones)

Run opendkim.sh on the secondary first to set up the service and populate KeyTable/SigningTable/TrustedHosts, then replace its generated keys with the primary’s keys:

# On secondary: run opendkim.sh first to install and configure everything
cd /usr/local/src/centminmod
addons/opendkim.sh

# Stop opendkim on secondary before replacing keys
systemctl stop opendkim

# On primary: rsync keys to secondary (overwrites secondary's generated keys)
rsync -avz --no-perms --no-owner --no-group \
  /etc/opendkim/keys/server.example.com/ \
  root@secondary-ip:/etc/opendkim/keys/server.example.com/

# On secondary: fix ownership and restart
chown -R opendkim: /etc/opendkim/keys/server.example.com/
systemctl start opendkim

One DNS TXT record covers both servers. The public key is in /etc/opendkim/keys/server.example.com/default2026.txt on the primary server.

Option B — Use a unique selector on the secondary server

# On secondary: generate with a custom selector suffix
cd /usr/local/src/centminmod
SELECTOR="default2026sec" addons/opendkim.sh

# Verify secondary config
addons/opendkim.sh check

# Verify DNS record propagated for the secondary selector
dig +short default2026sec._domainkey.server.example.com TXT

With Option B, two DNS TXT records are required: default2026._domainkey (primary) and default2026sec._domainkey (secondary).

Scenario 2 — Same hosted site domain (vhostname) on both servers

This applies when both servers host the same domain (e.g., mysite.com) and you pass it as an argument. Running addons/opendkim.sh mysite.com triggers this path.

Option A — Share the same DKIM private key (recommended for standby/failover clones)

# On secondary: run opendkim.sh for the vhostname first
cd /usr/local/src/centminmod
addons/opendkim.sh mysite.com

# Stop opendkim on secondary before replacing keys
systemctl stop opendkim

# On primary: rsync vhostname keys to secondary
rsync -avz --no-perms --no-owner --no-group \
  /etc/opendkim/keys/mysite.com/ \
  root@secondary-ip:/etc/opendkim/keys/mysite.com/

# On secondary: fix ownership and restart
chown -R opendkim: /etc/opendkim/keys/mysite.com/
systemctl start opendkim

Option B — Use a unique selector on the secondary server

# On secondary: generate with a custom selector suffix
SELECTOR="default2026sec" addons/opendkim.sh mysite.com

# Verify DNS record for secondary selector
dig +short default2026sec._domainkey.mysite.com TXT

Which option to choose:

Verify DKIM configuration on either server:

cd /usr/local/src/centminmod
addons/opendkim.sh check

# Verify DNS TXT record is live (main hostname)
dig +short default2026._domainkey.server.example.com TXT

# Verify DNS TXT record is live (vhostname)
dig +short default2026._domainkey.mysite.com TXT

See the OpenDKIM Multi-Server Setup guide for full details.

Check the install logs at /root/centminlogs/ for error details. Common causes include YUM/DNF repo failures, network/DNS timeouts, insufficient disk space or swap, and SELinux interference. The installer can be safely re-run after fixing the underlying issue.

For the full troubleshooting guide, see Troubleshooting — Initial Install Failures. Also see the forum discussion.

Four caching options via the wpscache variable: Cache Enabler (default), Redis nginx-level cache, WP Super Cache, and FastCGI cache. Redis requires the Redis Nginx module, and FastCGI cache requires WP_FASTCGI_CACHE='y' in /etc/centminmod/custom_config.inc.

For full details, see WordPress Caching Options. Also see the forum discussion.

Deactivate and delete the Cache Enabler plugin, then run tools/wp-cache-enabler-generate.sh to clean up Nginx configs. Reinstall WordPress on the same domain via menu option 22, selecting the Redis cache option.

For the full switching guide, see Switching Cache Plugins. Also see the forum discussion.

Install WP-CLI with addons/wpcli.sh install. After installation, use the wp alias (runs WP-CLI with --allow-root). Common commands: wp plugin update --all, wp core update.

For full details, see WP-CLI Management. Also see the forum discussion.

Use top/htop to identify the process consuming CPU. Common causes: PHP-FPM worker storms, MySQL slow queries, and OPcache misconfiguration. Use sar and dstat for historical analysis.

For the full diagnosis guide, see Troubleshooting — High CPU Load. Also see the forum discussion.

Run tools/cf-authenticated-origin-cert-update.sh to download and configure the Cloudflare origin pull certificate. A weekly cron job auto-renews the certificate before its 180-day expiry. Enable ssl_verify_client in the Nginx vhost to enforce mTLS.

For full details, see Cloudflare — Authenticated Origin Pulls. Also see the forum discussion.

WordPress 403 errors are usually caused by tools/autoprotect.sh blocking wp-login.php and xmlrpc.php. Create a .autoprotect-bypass file in the domain’s public directory to skip protection, or adjust the VHOSTCTRL_AUTOPROTECTINC variable. Also verify file ownership is nginx:nginx.

For the full guide, see Troubleshooting — WordPress 403 Errors. Also see the forum discussion.

Follow the email deliverability checklist: PTR/rDNS record, SPF record, DKIM via addons/opendkim.sh, DMARC record progression (none → quarantine → reject), and HELO hostname match. Test with mail-tester.com. For production email, use a transactional service like Amazon SES, SendGrid, or Mailgun.

For the complete checklist, see Email — Deliverability Checklist. Also see the forum discussion.