inetp CLI Reference
The inetp command-line tool is installed at /usr/local/bin/inetp after setup.
inetp CLI Reference
Account Management
| Command | Description |
|---|---|
inetp create_account --username <user> --domain <domain> --password <pass> | Create a hosting account and its first domain in one step. Auto-assigns a port and creates the Linux user, Apache vhost, PHP-FPM pool, FTP access, SSL certificate and MariaDB user. |
inetp create_user --username <user> --password <pass> | Create a hosting user only, with no domains. Add domains afterwards with add_domain. |
inetp delete_user --username <user> [--force] [--no-backup] | Delete a hosting user and everything it owns: databases, MariaDB user, crontab, FTP entry, home directory and panel records. Takes a final backup first unless --no-backup. Refuses while domains remain unless --force. Safe to re-run — it resumes an interrupted deletion. |
inetp delete_account --username <user> --confirm [--no-backup] | Remove every domain for a user, then the user itself. Re-runnable; resumes if a previous attempt was interrupted. |
inetp add_domain --username <user> --domain <domain> [--port <n>] [--php-version 8.4] | Add an additional domain to an existing hosting account. |
inetp remove_domain --username <user> --domain <domain> [--no-backup] | Remove one domain: vhost, listening port, FPM pool, SSL certificate, that domain's database and its files. Leaves the user and their other domains alone. |
inetp suspend_account --username <user> --suspend|--resume | Suspend or resume a hosting account. Serves a suspended page and locks the login without deleting anything. |
inetp change_password --username <user> --password <pass> | Change the system password for a hosting account (used for FTP, SSH and the account portal). |
inetp reset_password --username <user> [--password <pass>] | Reset the FTP/SSH/MariaDB password for a user. Generates one if not supplied. |
inetp fix_permissions <username> | Reset file and directory ownership and permissions for a hosting account web root. |
inetp list | List all hosting accounts with port, PHP version, and disk usage. |
SSL Management
| Command | Description |
|---|---|
inetp ssl_manage issue <domain> | Issue a new Let's Encrypt certificate for a domain via Cloudflare DNS-01 challenge. |
inetp ssl_manage revoke <domain> | Revoke the Let's Encrypt certificate for a domain. |
inetp ssl_manage renew <domain> | Force renew the SSL certificate for a specific domain. |
inetp ssl_manage status | List all SSL certificates with expiry dates and renewal status. |
inetp panel_ssl <hostname> | Replace the panel self-signed certificate with a trusted one. Since 1.26 the installer serves the setup wizard over HTTPS from the start; run this to move the panel onto a real certificate. |
WireGuard VPN
| Command | Description |
|---|---|
inetp wireguard_setup | Interactive WireGuard VPN setup wizard (port, subnet, endpoint, auto-peer). |
inetp wireguard_uninstall | Remove WireGuard VPN configuration and disable the VPN interface. |
inetp wg_peer add <name> | Add a new WireGuard peer by name. Generates keys and config automatically. |
inetp wg_peer delete <name> | Remove a WireGuard peer by name. |
inetp wg_peer qr <name> | Display the WireGuard QR code for a peer in the terminal (for mobile app scanning). |
Firewall & Security
| Command | Description |
|---|---|
inetp firewall status | Show firewall status, active zones, and fail2ban jail statuses. |
inetp firewall ban <ip> | Manually ban an IP address via fail2ban. |
inetp firewall unban <ip> | Unban an IP address from all fail2ban jails. |
inetp firewall flush | Flush all fail2ban bans (use with caution). |
inetp qsa_scan | Run an external exposure scan of this server's public IPv4 through qsa.sh and print it as it runs. The scan originates outside your network, so it reports what an attacker actually reaches: open TCP ports, service versions, CVE matches and high-signal exposure checks. With a Full or Deep token it waits for the asynchronous report. Results are kept on this server (last 30 runs, readable by root only) and shown on Firewall → Exposure Scan. Same as inetp tsvc qsa run. |
inetp qsa_scan --monitor | Scheduled re-scan: compares open ports, service versions and findings with the last complete scan and alerts only on a real change. A scan cut off at a time limit is never compared, the free tier runs at most once per 24 hours, and a Deep token is never used. A change raises a notice in the panel header and goes to the saved webhook. |
inetp qsa_scan --diff | Show the last detected exposure change. |
inetp qsa_scan --test-webhook | Send a test message to the saved webhook (Discord, Slack, ntfy or any https endpoint). |
inetp harden_panel | Keep the panel's private files private: the panel database directory 0700 and its files 0600, and Apache isolated from the panel's database, state and sessions. Safe to run at any time; restarts Apache only when its isolation settings change. inetp audit checks the result. |
Tuxxin Services
| Command | Description |
|---|---|
inetp tsvc status | Show which modules are on, which keys are saved (never the keys themselves) and each service's remaining free allowance. |
inetp tsvc qsa run | External exposure scan of this server (same as inetp qsa_scan). |
inetp tsvc qsa history | List the saved scans with their result and open-port count. |
inetp tsvc worldip <ip> | Look up an IP address on worldip.io: country, network, reverse DNS. Use self for this server's public IPv4. Cached for 24 hours. |
inetp tsvc issued <domain> | Domain registration and certificate expiry for a hosted domain, from issued.live. |
inetp tsvc webshot queue <domain> | Queue a new screenshot of a hosted site (webshot.site). Screenshots are taken a few at a time to stay within the free limit. |
inetp tsvc whack start <domain> | Start a malware and phishing scan of a hosted site with whack.sh (needs a whack.sh key). |
inetp tsvc set-secret <name> | Save a key read from standard input: qsa_token, worldip_key, issued_key, webshot_key, whack_key or webhook_url. Stored where only root can read it. |
inetp tsvc notify-test | Send a test message to the saved webhook. |
inetp tsvc selftest | Run the built-in self-checks. |
Backups & Utilities
| Command | Description |
|---|---|
inetp backup_accounts | Trigger a full backup of all hosting accounts immediately (files + databases). |
inetp restore_account --username <user> --backup-file <path> | Restore an account from a backup archive. |
inetp s3_backup status | Show the last remote (S3) upload run. |
inetp s3_backup upload | Start a background upload of any backups not yet in the S3 bucket, then apply remote retention. |
inetp s3_backup test | Check the saved S3 settings against the bucket. |
inetp s3_backup retention --dry-run | List which remote backups retention would delete, without deleting anything. |
inetp optimize_images | Run image optimization (pngquant, cwebp, gifsicle) on all hosting account web roots. |
inetp optimize_server | Auto-tune Apache and MariaDB for this server's CPU and memory. |
inetp cleanup [--dry-run] | Remove temp files, old logs and orphaned PHP-FPM pools. --dry-run reports without deleting. |
inetp rotate_logs | Force log rotation for all system and hosting account logs. |
inetp db_repair | Check and repair MariaDB tables, and vacuum the panel SQLite database. |
inetp panel_update | Update iNetPanel to the latest release from GitHub. Runs migrations automatically. |
inetp panel_update --force | Force reinstall the latest release even if already on the current version. |
inetp check_domains | Check domain availability via RDAP. Free, no API key required. |
inetp update | Run a system package update. |
inetp -v | Display the installed iNetPanel version. |
inetp --help | Display all available commands and usage. |
Diagnostics & Repair
These read the server and report. audit_orphans, status,
dns_check and disk_report change nothing at all, so they are
always safe to run on a live server.
| Command | Description |
|---|---|
inetp status | Server health summary: uptime, load, memory, disk, service states, SSL expiry, backup age and account counts. |
inetp audit_orphans | Cross-reference every hosting account against the system and report anything that has drifted, in both directions — accounts with missing pieces, and leftover resources with no account. Covers system users, home directories, the FTP allowlist, crontabs, databases, MariaDB users, Apache vhosts, PHP-FPM pools, certificates, ports and unfinished deletions. Read-only, with no --fix mode by design. |
inetp audit_orphans --user <user> | Same checks scoped to one account. Exits 0 when clean, 1 when something was found, 2 when it could not check. |
inetp rebuild_vhosts --check | Report Apache vhosts that are missing for a known domain, or orphaned because the account they point at is gone. An orphaned vhost stops Apache starting at its next restart, which takes every site on the server down, so this is worth running after any failed deletion. |
inetp rebuild_vhosts [--disable-orphans] | Regenerate missing vhosts from the panel database. With --disable-orphans, also disables the broken ones it finds. |
inetp rebuild_pools | Regenerate any missing PHP-FPM pool configs from the panel database. |
inetp cf_remoteip | Configure Apache’s mod_remoteip with Cloudflare’s published IP ranges so hosted sites see the real visitor address. Behind a Cloudflare Tunnel, cloudflared connects over loopback, so without this every site sees 127.0.0.1 for every request — per-IP rate limiting in your apps becomes one global bucket, access logs are useless for abuse work, and the panel’s fail2ban jail cannot ban anything. Refreshed weekly by cron; run manually after changing tunnel setup. |
inetp cf_remoteip --check | Report whether mod_remoteip is active and how many Cloudflare ranges are currently trusted. |
inetp session_reaper --dry-run | Report how many expired PHP session files each site has accumulated, without deleting anything. Debian’s session cleaner cannot see the panel’s per-pool session paths, so nothing removed them before v1.26.1 — one account reached 4.2 million files. |
inetp session_reaper | Delete expired session files, honouring session.gc_maxlifetime. Runs hourly by cron. Works in bounded batches with nice/ionice, because an unbounded delete over millions of files can stall a server. |
inetp dns_check <domain> | DNS, SSL and connectivity diagnostics for one domain, checked against several public resolvers. Useful first step when a site returns 502 through a Cloudflare tunnel. |
inetp disk_report | Disk usage broken down by hosting user and domain. |
inetp audit | Security audit: file permissions, open ports, SSL, SSH configuration and PHP settings. |
inetp malware_scan | Scan hosting account PHP files for backdoors and webshells. |
inetp benchmark | Quick server benchmark: disk, network, PHP and MySQL. |
inetp speedtest | Network bandwidth test. |
PHP Version Management
| Command | Description |
|---|---|
inetp multiphp_manage --action <action> --version <ver> | Install, remove or set the default PHP version. |
inetp multiphp_manage --action switch --domain <domain> --version <ver> | Switch a single domain to a different installed PHP version. |
A note on arguments. Most
inetp subcommands take named
flags rather than positional arguments — inetp delete_user --username bob,
not inetp delete_user bob. If a command replies that an argument is
required when you appear to have supplied it, that is usually why.
inetp dns_check accepts either form.