Knowledgebase

Polar55 offers developer-friendly web hosting, so naturally, you also have access to the terminal, both via SSH and directly through cPanel.

Using the terminal can feel a little intimidating, and most people are unsure where to start. However, AI has made it much easier: you can simply copy commands from an AI tool into the terminal and then give it the output. It can then suggest the next command based on what you want to investigate.

In this guide, we will show you a few examples of what you can use the terminal for. However, it is worth emphasising that it becomes truly effective when you use AI to both generate your commands and analyse their output.

Investigate high CPU usage and possible bot traffic

Is your web hosting account using a lot of CPU, or is your website slow? This could be caused by automated bots or large numbers of repeated requests to your website.

You can use cPanel Terminal to investigate traffic to your websites. You will find Terminal under Advanced → Terminal in cPanel. The commands below are read-only and do not change anything on your hosting account.

Find the most active User-Agents

A User-Agent is the identification string that a browser or bot sends with its request. The following command shows which User-Agents have made the most HTTP 200 requests in the last 60 minutes:

grep -hE "$(for i in $(seq 0 59); do LC_ALL=C date -d "$i minutes ago" '+%d/%b/%Y:%H:%M'; done | paste -sd'|' -)" \
~/access-logs/* 2>/dev/null \
| awk -F'"' '$3 ~ /^ 200 / {
    ua=$6;
    if (ua=="") ua="-";
    print ua
}' \
| sort | uniq -c | sort -nr | head -100

Example output:

1662 Mozilla/5.0 ... Edg/156.0.0.0
 810 Mozilla/5.0 ... Chrome/156.0.0.0 Mobile
 479 WP Rocket/Preload
  96 Mozilla/5.0 ... bingbot/2.0

The number on the left shows the number of requests. If one User-Agent stands out significantly, you can investigate which IP addresses the traffic is coming from.

Note: A high number of requests is not necessarily suspicious. For example, WP Rocket can generate many requests while building its cache. User-Agents can also be spoofed. The command only shows HTTP 200 responses, excluding responses such as HTTP 403 or 429.

Find the IP addresses behind a specific User-Agent

Copy the User-Agent you want to investigate and paste it between the quotation marks after UA=. Here, we use Microsoft Edge as an example:

UA='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.0.0 Safari/537.36 Edg/156.0.0.0'

grep -hE "$(for i in $(seq 0 59); do LC_ALL=C date -d "$i minutes ago" '+%d/%b/%Y:%H:%M'; done | paste -sd'|' -)" \
~/access-logs/* 2>/dev/null \
| awk -F'"' -v ua="$UA" '
    $3 ~ /^ 200 / && $6 == ua {
        split($1,a," ")
        print a[1]
    }
' \
| sort | uniq -c | sort -nr | head -20

Example output:

865 192.0.2.10
591 198.51.100.20
  1 203.0.113.30

Here, you can see that most of the requests come from two IP addresses.

Block an IP address through cPanel

If you have investigated the traffic and determined that an IP address is causing problems, you can block it through cPanel:

1. Log in to cPanel.
2. Open Security → IP Blocker.
3. Enter the IP address you want to block.
4. Click Add.
5. Repeat for additional IP addresses if needed.

You can unblock the IP address in the same place later. Keep in mind that an IP address may also belong to a legitimate visitor or a shared internet connection.

Find out which domain receives the most traffic

If you have multiple websites on the same cPanel account, you can check which domain has received the most requests in the last 60 minutes. This can help you identify which website to investigate further when CPU usage is high.

python3 - <<'PY'
import glob
import json
import os
import re
import subprocess
from collections import Counter
from datetime import datetime, timedelta

now = datetime.now().astimezone()
start = now - timedelta(minutes=60)

counts = Counter()
domains = {}

# Retrieve the correct domain mapping from cPanel
try:
    result = subprocess.run(
        ['uapi', '--output=json', 'DomainInfo', 'domains_data'],
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,
        universal_newlines=True,
        timeout=15
    )

    if result.returncode == 0:
        response = json.loads(result.stdout)
        data = response.get('result', {}).get('data') or {}

        for category in ('addon_domains', 'sub_domains'):
            for item in data.get(category) or []:
                if not isinstance(item, dict):
                    continue

                internal = item.get('servername')
                public = item.get('domain')

                if internal and public:
                    domains[internal] = public

        main = data.get('main_domain') or {}
        if isinstance(main, dict):
            internal = main.get('servername')
            public = main.get('domain')

            if internal and public:
                domains[internal] = public

except (OSError, ValueError, subprocess.TimeoutExpired):
    pass

# Scan access logs for requests from the last 60 minutes
seen = set()

for path in glob.glob(os.path.expanduser('~/access-logs/*')):
    try:
        if not os.path.isfile(path):
            continue

        stat = os.stat(path)
        identity = (stat.st_dev, stat.st_ino)

        # Avoid reading the same file through multiple hard links
        if identity in seen:
            continue
        seen.add(identity)

        name = os.path.basename(path)
        name = re.sub(r'-ssl_log$', '', name)

        # Display the correct domain name from cPanel
        domain = domains.get(name, name)

        with open(path, errors='replace') as logfile:
            for line in logfile:
                match = re.search(r'\[([^\]]+)\]', line)

                if not match:
                    continue

                try:
                    timestamp = datetime.strptime(
                        match.group(1),
                        '%d/%b/%Y:%H:%M:%S %z'
                    )
                except ValueError:
                    continue

                if start <= timestamp <= now:
                    counts[domain] += 1

    except OSError:
        continue

print('REQUESTS PER DOMAIN – LAST 60 MINUTES')
print()

for domain, count in counts.most_common():
    print('{:8}  {}'.format(count, domain))
PY

Example output:

REQUESTS PER DOMAIN – LAST 60 MINUTES

    4821  website-a.com
     936  website-b.com
     124  website-c.com

In this example, website-a.com receives far more traffic than the other websites.

However, a high number of requests does not necessarily mean high CPU usage. A single resource-intensive WordPress request can put more strain on the server than many cached requests. These figures therefore provide an indication, rather than a direct measurement of CPU usage.

Check disk usage and find the largest files

Is your hosting account running out of disk space? You can use Terminal to find the largest files on your account. This is especially useful for finding old backups, large log files and other files that may no longer be needed.

Find the 20 largest files

find ~ -type f -printf '%s %p\n' 2>/dev/null \
| sort -nr | head -20 \
| awk '{printf "%.1f MB  %s\n", $1/1048576, $2}'

Example output:

1850.4 MB  /home/user/backups/backup-old.zip
 724.2 MB  /home/user/public_html/wp-content/backup.zip
 312.8 MB  /home/user/public_html/error_log

Be patient: The command may take several minutes to complete, especially if your account contains many files.

This command is useful for identifying opportunities to free up space on your hosting account. It does not delete anything.

Important: Never delete files unless you know what they are used for. Consider reviewing them in cPanel's File Manager before deleting anything.