See it. Get told. Act.
Bots, scrapers and attack tools hit every website, every day. Amira shows you what is happening on your server in plain words, tells you when something needs attention, and lets you stop it in one click. It is built into the panel, not sold as an add-on.
What is happening on your server, in plain words
Most requests to a website are not people. Some are search engines you want. Some are AI crawlers copying your pages, programs copying your listings one by one, or tools guessing WordPress passwords and looking for leaked config files. Security → Bot Protection sorts them out and says what each one does.
Who visits each site
Attackers and scanners, AI crawlers, scripts, SEO tools, search engines and link previews, each with what it does in plain words, what it costs your server, its network and country. Fake Googlebots are caught by a DNS check.
AgencyWho copies your content
Every 15 minutes the panel looks for scraping: pages read without styles, record numbers fetched in order, many addresses of one cloud provider sharing the work, and WordPress login attacks across sites.
AgencyWhere attacks come from
The Threat Map shows blocked and banned traffic on a world map, with a live feed and the top attackers. Country flags appear next to addresses in the firewall, fail2ban and WAF logs.
AgencyWhat your own accounts do
The Outgoing tab catches a hacked site that mines crypto, guesses SSH passwords on other servers, scans ports or sends spam. Direct mail on port 25 is blocked by default.
AgencyExamples in the panel's own wording; site names and numbers are made up. Bot activity, scraping findings and the Outgoing tab are in Agency.
Alerts where you already look
Send security events to email, Telegram or a webhook (for example Slack or Discord). Choose a minimum severity and which events each channel gets. A bot finding is sent once a day, not every 15 minutes.
Agency can send all of these. Solo sends the malware, suspicious-process, rootkit, Lynis, blocklist and mailbox alerts.
One click, previewed, easy to undo
Every finding comes with what to do, the recommended choice first. You see the effect before anything changes.
Block on the server
An address, a whole network or a bot by name, on one website or all of them. The preview shows what it did in the last 24 hours.
Challenge or block at Cloudflare
On a proxied site: people pass the challenge, copying programs fail. Nothing changes on the server.
Block AI crawlers
One switch per site writes GPTBot, ClaudeBot, CCBot and others into robots.txt and refuses them with 403. Search engines keep working.
Stop a hacked account
Slow its outgoing connections down, block them while its sites keep working, or suspend it. Auto Suspend rules can do this by themselves.
Undo any of it
Everything made here is listed with a Remove button, and every action is written to the audit log. Search engines and private addresses are never blocked by mistake.
One-click bot actions, account limits and Auto Suspend are in Agency. Every edition can block addresses on the firewall and IP blocklist.
Every layer, built in
"All editions" includes the free Solo Community. Each layer works in the panel, and most of them through your AI assistant too.
Web Application Firewall
ModSecurity with the OWASP Core Rule Set. JSON bodies checked, blocked requests explained, exceptions for one field on one page of one site.
Bot Protection
Rules by user agent, path or referer. Agency adds addresses and networks, the Activity and Scraping tabs and one-click blocks.
Cloudflare protection per site
Send a site through Cloudflare, then lock the origin so anyone using the server's IP directly gets 403. Works on Cloudflare's free plan.
Firewall and fail2ban
UFW for IPv4 and IPv6, deny rules on top. fail2ban jails for SSH, mail logins, FTP, webmail and bots that try to relay spam. Panel sign-in is rate-limited.
Login Protection for mailboxes
Failed mail logins per mailbox; password guessing from many addresses locks a weak mailbox to the places it normally logs in from.
2FA, audit log, scoped API keys
TOTP two-factor sign-in, a searchable log of sign-ins, security changes and AI actions, and API keys limited to read, deploy or manage.
Malware scanner
ClamAV scans on a schedule and moves infected files to quarantine. Its scanning service is started when your server has room.
Rootkit scans and Lynis
rkhunter and chkrootkit look for rootkits; Lynis audits the server's hardening and reports its score.
Process Monitor and Auto Suspend
Finds crypto miners, reverse shells and CPU hogs. In Agency, Auto Suspend rules can suspend an account on malware, a suspicious process or attacks on other servers.
WordPress Security
The security check of every WordPress site on one page, safe fixes in bulk, and a daily scan that alerts on new serious problems.
Database scanner
Checks MySQL and PostgreSQL for unsafe settings: users without passwords, remote root logins, "trust" logins, SSL.
Account isolation
Each hosting account has its own Linux user and a 0750 home; a guard removes links into other homes; terminal, web IDE and git builds run in a bubblewrap sandbox.
Spam cannot leave quietly
Sending limits hold mail over the hourly or daily limit and pause a hacked mailbox. Agency also blocks direct mail on port 25 from hosting accounts.
RBL monitor
Checks the server's sending addresses against 7 blocklists and alerts when one is listed.
Automatic PHP security updates
PHP fixes install by themselves and the web server reloads gracefully. When a flaw has no fix yet, the advised safe setting is applied.
Backups with a disk guard
Scheduled backups that refuse to start when they would fill the disk, so a backup never takes the server down.
Security Checkup
About 35 checks every night give a score from 0 to 100, with what to do and one-click fixes after you confirm.
Threat Map
A live world map of blocked and banned traffic, the top attackers and a Block button.
Built in vs bought separately
On many servers, security is added with separate products. In Amira these layers are part of the panel, at no extra cost.
| Area | Amira (included) | Typical add-on | How it is usually sold |
|---|---|---|---|
| Server WAF and malware scanning | ModSecurity + OWASP Core Rule Set with per-site exceptions; ClamAV scans with quarantine. | Server security suites such as Imunify360 (CloudLinux) or BitNinja, which also bundle a WAF and a malware scanner. | A separate licence per server. Imunify360 is listed at $144 a year for a server with one hosting account, $300 for up to 30, $420 for up to 250 and $540 for more (per server, as of October 2026; less from 5 servers). |
| WordPress protection | The server WAF covers every site; WordPress Security checks all WordPress sites at once and applies safe fixes in bulk (Agency). | WordPress plugins and services such as Wordfence or Patchstack. Wordfence's free version gets new firewall rules and malware signatures 30 days after Premium. | Usually a paid licence per site or per installation. |
| Edge WAF in front of the server | Puts any site behind Cloudflare's proxy and locks the origin, on any Cloudflare plan including Free. The OWASP rules run on your own server. | Cloudflare's Cloudflare Managed Ruleset and OWASP Core Ruleset, which need the Pro plan or higher (the Free plan has the Free Managed Ruleset). | Cloudflare Pro is listed at $20 a month billed yearly (as of October 2026). |
| Bot visibility and scraping | Activity, scraping findings, fake-search-engine checks, one-click blocks and the Block AI crawlers switch (Agency). | Bot management at the edge, for example Cloudflare's higher plans, which add sophisticated-bot mitigation and bot analytics. | Part of higher-priced CDN plans. |
| Outgoing abuse and spam from hacked sites | Outgoing connections judged per account, direct port 25 blocked, sending limits with held mail (limits in every edition; the rest Agency). | Outgoing-mail controls in server security suites, for example Imunify360's SMTP Traffic Manager or BitNinja's Outbound Spam Detection. | Part of the per-server suite licence. |
Where a dedicated product does more
We would rather you know this before you choose:
- Imunify360 can clean infected files automatically and restore the original if needed, and its Proactive Defense can stop a malicious PHP script while it runs. Amira's scanner finds and quarantines infected files, but does not clean them.
- BitNinja shares address reputation across the many servers it protects. Amira's bot watch judges what your own server sees.
- Wordfence Premium, Patchstack and Imunify360's WordPress plugin follow vulnerabilities in WordPress plugins and ship rules for them. Amira's WordPress Security shows plugin updates waiting, but does not use a plugin vulnerability database.
- Live kernel patching applies Linux kernel fixes without a reboot: KernelCare comes free with an Imunify360 licence. On Amira, kernel updates from Ubuntu take effect after a reboot.
- Imunify360's Reputation Management checks your domains against phishing and safe-browsing lists. Amira's RBL Monitor checks the server's addresses on mail blocklists.
- Cloudflare stops attacks and traffic floods at its edge, before they reach your server. Amira's WAF and bot blocks run on your server; with Cloudflare protection per site you can use both.
If you need one of these, check with the vendor that it supports your server setup.
Facts about other products come from each vendor's own website, checked in October 2026. Features and prices change; check the vendor's site before you buy. Imunify360, BitNinja, Wordfence, Patchstack, Cloudflare and KernelCare are trademarks of their respective owners, used here only to name their products. Amira Panel is not affiliated with them.
Sources:
- Imunify360 pricing (per server, yearly and 5+ servers)
- Imunify360 docs: admin interface (cleanup, Proactive Defense, SMTP Traffic Manager, KernelCare)
- BitNinja: features
- BitNinja: pricing ("priced per server by hosted users")
- Wordfence plugin page (free vs Premium)
- Patchstack pricing
- Cloudflare plans
- Cloudflare WAF managed rules: availability
- TuxCare KernelCare
Questions about security
Know what is happening on your server
Start with Solo Community for free, or see the full security view in the Agency demo.