Skip to content

Install, update and remove the server agent

What the WP Safer agent needs, what it installs on your server, how to check the install script first, how it updates itself and how to remove it.

Last updated

The WP Safer agent is a small service on your Linux server. It reports to WP Safer every minute over outgoing HTTPS, so no inbound port is opened. This article covers what it needs, what it installs, how it is updated and how to remove it.

Requirements

  • Linux with systemd: Ubuntu 20.04+, Debian 11+, RHEL / AlmaLinux / Rocky 8+
  • Root access (sudo) to run the install command
  • Outgoing HTTPS (port 443) to wpsafer.com. No inbound port is needed.
  • A free server slot in your server subscription (see Add a Linux server).

Install

  1. Go to Servers → Add server, name the server, choose Install the agent and press Create install command.
  2. Run the command on the server as root: 
    curl -fsSL https://wpsafer.com/agent/install | sudo bash -s -- --code WPS-XXXXX-XXXXX
    The code is valid for 30 minutes and can be used once. For security it is shown only once; if you leave the page, Create install command gives you a new one.
  3. The installer checks the system first and writes nothing if a requirement is missing. It then connects the server to your account, installs the files and starts the service. If the service does not start or the first report does not arrive within 30 seconds, it removes what it wrote; the server stays in your panel and you can create a new code.
  4. When the screen says the server is connected, choose the services to watch under Which services should we watch? and press Start monitoring.

Review the script first

Under Review the script before running it, the panel shows the commands to download the script, print its SHA-256 checksum next to the one in the panel, and run it with the same code:

curl -fsSLo wpsafer-install https://wpsafer.com/agent/install
sha256sum wpsafer-install
sudo bash wpsafer-install --code WPS-XXXXX-XXXXX

The agent itself is embedded in that one file as plain text, so the checksum covers it too.

What is installed

  • /opt/wpsafer-agent/wpsafer-agent — the agent (a bash script), with a link at /usr/sbin/wpsafer-agent
  • /etc/wpsafer-agent/agent.conf — the server’s access token (readable by root only)
  • /var/lib/wpsafer-agent/ — state and temporary files
  • /var/log/wpsafer-agent.log — the agent’s log
  • /etc/systemd/system/wpsafer-agent.service — the systemd service

The agent runs only a fixed list of commands that WP Safer can request: refresh its settings, update itself, remove itself and run a backup job you created. It never runs a command typed into the panel. sudo wpsafer-agent status shows its state on the server.

Update

When a newer agent is available, the server page says so and names both versions. Press Update the agent; the update is queued and runs with the next report. Or run it on the server:

sudo wpsafer-agent self-update

The new version is checked against its SHA-256 checksum before it is installed. If it does not report within 30 seconds, the previous files are put back.

Pause monitoring

On the Settings tab, Pause monitoring stops incidents, alerts and backups for the server without removing the agent. A paused server does not use one of your server slots. Resume monitoring turns it back on if you have a free slot.

Remove the agent

  1. Open the server and go to the Settings tab.
  2. Under Remove the agent, press Remove the agent and confirm. Removal is queued and runs with the next report: the agent stops, deletes its files and the server is marked Agent removed.
  3. If the agent runs without root rights it refuses; then run this on the server: 
    sudo wpsafer-agent uninstall

Removing the agent keeps the server and its history in your panel. To remove the server itself, use Remove server on the same tab: monitoring stops at once and the agent shuts itself down the next time it reports; its files stay on the server until you run the uninstall command.

If the token may have leaked

Use Revoke the token and pair again (Revoke token) on the Settings tab if the token may have leaked or the server was rebuilt. The agent is rejected at its next report, and you get a new install code to connect it again.