Security
Multi-layer defense, automated by AI
WAF, bot protection, malware scanning, rootkit detection, firewall management, fail2ban, and 2FA — all manageable through the panel UI and the AI tools. Agency also shows which bots visit your sites and which accounts attack other servers, and stops them in one click.
Web Application Firewall (WAF)
ModSecurity with the OWASP Core Rule Set.
ModSecurity with the OWASP Core Rule Set protects every hosted site from SQL injection, XSS, file inclusion and other common attacks. Agency installs it switched on at paranoia level 1. Solo installs it switched off, so nothing gets blocked by surprise; turn it on with one switch. JSON request bodies are checked field by field, like form posts. Choose a paranoia level and see blocked requests in the event log. With Solo Full or Agency, the AI tools can configure the WAF and review its events.
Web Application Firewall (WAF)
Blocked Requests Explained, Per-Site Exceptions
See why a request got 403, and allow it on one page of one site instead of the whole server.
Each WAF event shows the page, every rule that matched with the field it matched, and a plain sentence such as "The password field looked like a database attack". Passwords and tokens are hidden, and a warning shows when the request looks like a real attack. "Allow this" opens a ready-made exception: one rule ignores one field on the pages of one site that start with a given path, and you see the exact rule before it is written. In Agency, website owners see and allow the blocked requests of their own sites on their Web Firewall page. Managing exceptions with the AI tools needs Solo Full or Agency.
Blocked Requests Explained, Per-Site Exceptions
Bot Protection Rules
Block bad bots by name, path or referer, plus IP blocklists.
Rules match a user agent, a request path or a referer and refuse the request with 403; the IP Blocklist page blocks addresses. Solo applies rules per domain. Agency applies them to one website or all, and can also match an address, a range or a whole network. Every edition manages the rules in the panel; the AI tools for them need Solo Full or Agency.
Bot Protection Rules
Bot Activity: Who Visits and What They Do
Every bot and script on your sites, grouped by kind and described in plain words.
Security → Bot Protection → Activity groups the clients of one site or all sites: attackers and scanners, browsers that read like machines, AI crawlers, scripts, SEO tools, search engines, link previews and monitors. Each row says what the client does ("Trying WordPress logins (40)", "Scanning for leaked config files", "Fetching records one after another: /listing/{n}"), what it costs in requests, data and server time, and its network and country, from the last hour to 14 days. Search engines are checked by reverse and forward DNS, so a fake Googlebot is listed as an attacker. People reading a few pages are not stored, and the addresses kept for blocking are deleted after 14 days.
Bot Activity: Who Visits and What They Do
Scraping Detection and Canary Records
Finds programs copying your listings, even when many addresses share the work.
Every 15 minutes the panel judges the last 24 hours of each site: pages an hour, pages read without styles or images, record numbers fetched in order (/item/1, /item/2…), busy day and night, programs from cloud data centres, and many addresses of one provider sharing the work. It also spots WordPress login campaigns across sites and fake search engines. Findings come with the evidence and recommended actions, and go to your notification channels. To prove that a copy came from your data, the canary generator makes unique fake entries (a business name, a Lao mobile number, an email address, a street address) to plant on pages only a copying program reaches.
Scraping Detection and Canary Records
One-Click Blocks, on the Server or at Cloudflare
Block an address, a whole network or a bot, previewed first and easy to undo.
Block a client on one website or all of them, or challenge or block it at Cloudflare on a proxied site. The preview shows what the target did in the last 24 hours; verified search engines, private addresses and Cloudflare's own network are refused. Everything made here is listed with a Remove button and written to the audit log. A "Block AI crawlers" switch per website writes GPTBot, ClaudeBot, CCBot, Bytespider, PerplexityBot and others into robots.txt and also refuses them with 403, because many ignore robots.txt. Search engines and assistants fetching a page for a person are not blocked.
One-Click Blocks, on the Server or at Cloudflare
Outgoing: Bots Running on Your Server
Catch a hacked site that mines, guesses SSH passwords, sends spam or scans others.
The Outgoing tab counts each hosting account's new connections to other servers and judges them every 5 minutes: crypto-mining pools, SSH password guessing, spam sent straight to port 25, port scans and mass connections to websites. Findings raise an alert, and an Auto Suspend rule ("Attacks other servers") can suspend the account by itself. Per account you can slow it down (60 new connections a minute), block its outgoing connections while its sites keep working, or suspend it. Direct mail on port 25 is blocked for hosting accounts by default, so sites send through the server's mail and its sending limits; one account can get an exception.
Outgoing: Bots Running on Your Server
Threat Map
A world map of blocked and banned traffic, with a live feed and a Block button.
Security → Threat Map shades countries by attempts and draws an arc to your server for every new event: port scans, closed ports with their usual service, web attacks and fail2ban bans, for the last hour, day or week. The top attackers are listed with what they tried. Country flags appear next to IP addresses on the firewall, fail2ban and WAF pages. Countries come from a database on the server, so no address is sent anywhere.
Threat Map
WordPress Security
Scan every WordPress site at once and fix the safe problems in bulk.
One page shows the security check of every WordPress site you can see (admins: the whole server; resellers: their customers), with problems and plugin and theme updates waiting. Scan all runs in the background. Fix selected sets wp-config.php to 640, blocks PHP in uploads, turns off the file editor, directory listing and debug mode, and can update plugins after a backup of each site. A daily scan raises an alert when a site gets a new serious problem.
WordPress Security
Security Checkup
A nightly security score from 0 to 100, with clear fixes.
About 35 checks run every night and on demand: sign-in, SSH, firewall, WAF, antivirus, rootkit scans, mail, certificates, PHP versions, file permissions and backups. Each finding says what is wrong and what to do. Common problems have a one-click fix after you confirm, and you can accept a risk with a reason.
Security Checkup
Malware Scanner (ClamAV)
Scheduled scans, quarantine management, and auto-cleanup.
ClamAV scans files for malware, trojans, and viruses. Schedule daily or weekly scans, quarantine infected files, and review scan reports. AI-powered scanning (Solo Full+) can trigger scans, analyze results, and clean up threats automatically.
Malware Scanner (ClamAV)
Rootkit Detection
Lynis, rkhunter, and chkrootkit with detailed security reports.
Three rootkit detection tools work together: Lynis performs system auditing and hardening checks, rkhunter scans for known rootkits, and chkrootkit provides additional detection. Reports include actionable recommendations for improving server security.
Rootkit Detection
Firewall (UFW + fail2ban)
Port management with allow/deny rules and automatic brute-force protection.
UFW firewall with simple allow/deny rules for ports and IP ranges, for IPv4 and IPv6. Deny rules go to the top of the list, so a denied address cannot reach any open port. fail2ban watches the logs and bans addresses that keep failing to sign in to SSH, mail or FTP, and bots that try to relay spam through the server; each jail is described in plain words. Panel sign-in has its own rate limit. View banned IPs and unban them in the panel or with the AI tools.
Firewall (UFW + fail2ban)
2FA & Audit Logging
TOTP two-factor authentication and full action audit trail.
Enable TOTP 2FA (works with Google Authenticator, Authy and similar apps) for panel login. Sign-ins, security changes and every AI tool call are logged with time, user and details, and you can search the log in the panel.
2FA & Audit Logging
Automatic PHP Security Updates
PHP fixes install by themselves, and running PHP workers pick them up.
PHP security releases install automatically, and the web server then reloads gracefully so the new PHP serves requests. When a PHP flaw has no fix yet, the panel applies the safe setting the PHP project advises, as it did for session upload progress in October 2026.
Automatic PHP Security Updates
Try Security Today
Start free with Solo Community — 143 MCP tools and the full panel.