Security

Built into the panel

The website firewall, the attack map, and the signed-job path are part of the product.

Website firewall

  • WAF on the Nginx edge
  • SQL injection, XSS, path traversal, sensitive-file, and scanner blocking
  • IP, user-agent, and URL blacklists and whitelists, plus country rules
  • Rate limits, connection limits, and an Under Attack browser check
  • Real visitor IP when the site sits behind Cloudflare
  • Live attack map, top attackers, visited pages, and reports

Server protection

  • Open and close ports from the panel, using UFW or firewalld for that distribution
  • SSH and the panel port cannot be locked out from the panel
  • Fail2Ban automatic bans, also enforced in Nginx
  • Kernel DDoS hardening: SYN cookies and slow-client limits
  • Security score, SSH brute-force view, and pending security updates

Access control

  • Passwords hashed with argon2id, and TOTP two-factor authentication
  • Teams, roles, and fine-grained scopes
  • API keys limited to sites, servers, and IP ranges, with expiry and rotation
  • Tamper-evident, hash-chained audit log
  • Every server action is an Ed25519-signed job. The agent rejects anything else.
Open the firewall feature