# 🚨 Security Quick Reference Card

## Emergency Response

### Block an IP Immediately
```bash
# Method 1: Apache .htaccess (fastest)
sudo nano /var/www/html/sellzaki.com/production/public/.htaccess
# Add at top: Require not ip 41.44.117.225

# Method 2: Apache conf (recommended)
echo "<RequireAll>" | sudo tee /etc/apache2/conf-available/blocked-ips.conf
echo "    Require all granted" | sudo tee -a /etc/apache2/conf-available/blocked-ips.conf
echo "    Require not ip 41.44.117.225" | sudo tee -a /etc/apache2/conf-available/blocked-ips.conf
echo "</RequireAll>" | sudo tee -a /etc/apache2/conf-available/blocked-ips.conf
sudo a2enconf blocked-ips
sudo systemctl reload apache2

# Method 3: Laravel
php artisan security:block-ip 41.44.117.225 --minutes=1440

# Method 4: Firewall
sudo ufw deny from 41.44.117.225
```

### Unblock an IP
```bash
# Apache: Edit file and remove line
sudo nano /etc/apache2/conf-available/blocked-ips.conf
sudo systemctl reload apache2

# Or from .htaccess
sudo nano /var/www/html/sellzaki.com/production/public/.htaccess

# Laravel
php artisan security:unblock-ip 41.44.117.225

# Firewall
sudo ufw delete deny from 41.44.117.225
```

### Restart PHP-FPM (Free Workers)
```bash
sudo systemctl restart php8.2-fpm
```

---

## Monitoring

### Find Abusive IPs
```bash
# Top 10 IPs
sudo tail -10000 /var/log/apache2/sellzaki-access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head -10

# What they're hitting
sudo grep "SUSPICIOUS_IP" /var/log/apache2/sellzaki-access.log | awk '{print $7}' | sort | uniq -c | sort -rn
```

### Check PHP-FPM Status
```bash
# Worker count (should be 5+)
ps aux | grep php-fpm | wc -l

# Service status
sudo systemctl status php8.2-fpm
```

### Watch Logs
```bash
# Laravel suspicious activity
tail -f storage/logs/laravel.log | grep -i "suspicious\|blocked"

# Apache access
tail -f /var/log/apache2/sellzaki-access.log

# Apache errors
tail -f /var/log/apache2/sellzaki-error.log

# mod_evasive (if installed)
sudo tail -f /var/log/apache2/mod_evasive/*
```

---

## Rate Limits

| Endpoint | Limit | Per |
|----------|-------|-----|
| `/api/products/search` | 10 | minute |
| `/api/customers/search` | 20 | minute |
| `/api/*/search` | 15 | minute |
| `/api/auth/login` | 5 | minute |
| General API | 1200 | minute |

---

## Deployment

### Deploy Security Updates
```bash
cd /var/www/html/sellzaki.com/production
git pull origin main
php artisan cache:clear
php artisan config:clear
php artisan route:clear
```

### Configure Apache Rate Limiting
```bash
# Install mod_evasive
sudo apt-get install libapache2-mod-evasive
sudo a2enmod evasive

# Configure
sudo nano /etc/apache2/mods-enabled/evasive.conf

# Add:
<IfModule mod_evasive20.c>
    DOSPageCount 5
    DOSSiteCount 50
    DOSBlockingPeriod 60
    DOSLogDir "/var/log/apache2/mod_evasive"
</IfModule>

# Create log directory
sudo mkdir -p /var/log/apache2/mod_evasive
sudo chown www-data:www-data /var/log/apache2/mod_evasive

# Test and reload
sudo apache2ctl configtest && sudo systemctl reload apache2
```

---

## Testing

### Test Rate Limiting
```bash
# Should get 429 after 10 requests
for i in {1..15}; do curl "https://tyson.sellzaki.com/api/products/search?q=test" -H "Authorization: Bearer TOKEN"; done
```

### Test Minimum Length
```bash
# Should fail (1 char)
curl "https://tyson.sellzaki.com/api/products/search?q=t" -H "Authorization: Bearer TOKEN"

# Should work (2+ chars)
curl "https://tyson.sellzaki.com/api/products/search?q=te" -H "Authorization: Bearer TOKEN"
```

---

## Rollback

### Remove Rate Limiting
```bash
# Edit routes/api.php
# Remove ->middleware('aggressive.throttle:10,1')

php artisan route:clear
```

### Remove Apache Limits
```bash
# Disable mod_evasive
sudo a2dismod evasive
sudo systemctl reload apache2
```

---

## Common Issues

### "Too Many Requests" for Legitimate Users
```bash
# Increase rate limit in routes/api.php
->middleware('aggressive.throttle:20,1')  # was 10

# Or whitelist their IP in nginx
allow 1.2.3.4;
```

### PHP-FPM Workers Still Full
```bash
# Check for slow queries
sudo tail -f /var/log/nginx/access.log | grep "search"

# Increase worker count
sudo nano /etc/php/8.2/fpm/pool.d/www.conf
# pm.max_children = 10  (was 5)
sudo systemctl restart php8.2-fpm
```

### Apache Won't Reload
```bash
# Test config
sudo apache2ctl configtest

# Check error
sudo tail -f /var/log/apache2/error.log

# Fix syntax, then reload
sudo systemctl reload apache2
```

---

## Security Indicators

### 🟢 Normal
- PHP-FPM workers: 5 available
- Request rate: < 100/min per IP
- Response time: < 500ms
- No 429 errors in logs

### 🟡 Warning
- PHP-FPM workers: 2-3 available
- Request rate: 100-200/min per IP
- Response time: 500ms-1s
- Occasional 429 errors

### 🔴 Attack
- PHP-FPM workers: 0 available
- Request rate: > 200/min per IP
- Response time: Timeout
- Many 429 errors
- Single-char searches
- Same IP repeatedly

---

## Contacts

- **Laravel Logs**: `storage/logs/laravel.log`
- **Apache Logs**: `/var/log/apache2/sellzaki-access.log`
- **PHP-FPM Logs**: `/var/log/php8.2-fpm.log`
- **mod_evasive Logs**: `/var/log/apache2/mod_evasive/`
- **Config Files**: See `APACHE-DEPLOYMENT.md`

---

**Print this page and keep it handy for emergencies!**