Brute force protection
Watch failed login attempts and blocked IPs on every server from here, and unblock an IP when a customer locks themselves out. The screen follows the tool your panel already uses: cPHulk on cPanel/WHM, Fail2Ban jails on Plesk, Brute Force Monitor on DirectAdmin. Thresholds and the allow list sit on the same page.
- Topic
- E · Security
- Order
- 03 / 05
- Points
- 06
- Panel support
- 3 / 4 panels
- 01Engine follows the panelcPHulk on cPanel, Fail2Ban on Plesk, Brute Force Monitor on DirectAdmin.
- 02Thresholds per jailA jail-based engine keeps retries, find time and ban time per jail; the others show one threshold set.
- 03Unblock and allowUnblocking an IP can optionally add it to the allow list as well.
- 04The panel’s entry staysThe panel’s own allow-list entry cannot be removed: deleting it would lock the agent out.
- 05Clearing is confirmedAn ongoing attack refills the list at once, so clearing every block asks for confirmation.
What it does.
A customer locks themselves out from their own IP. You unblock it and tick one box to add it to the allow list, so the same call doesn’t come back half an hour later. If the attack is still going, tighten the thresholds or block the source for good. Clearing every block needs a separate confirmation, because the list refills within minutes while an attack is running.
The engine comes from the panel: cPHulk on cPanel, Fail2Ban on Plesk, Brute Force Monitor on DirectAdmin. A panel-less server has no protection installed, and that shows up as a finding.
Tabs follow the engine. Jail-based engines show each jail with its retries, find time and ban time; the others show one set of thresholds.
The services under attack are listed per panel: sshd, cpaneld, whostmgrd and webmaild on cPanel; plesk-panel, postfix, dovecot and proftpd on Plesk.
Unblocking an IP can add it to the allow list in the same step. Clearing every block asks for confirmation, since an ongoing attack refills the list at once.
You can block a source by hand, permanently or on a timer. An IP added to the allow list drops off the block list.
The panel’s own allow-list entry can’t be removed: deleting it would lock the agent out.
Which panels support it?
Capability Login protection thresholds
- yesManaged from the panel
- yesManaged from the panel
- yesManaged from the panel
- No panelnoNot possible on that panel
Servers without a control panel have no account, reseller or mailbox management, because those come from the panel itself. Firewall, DNS, services and the terminal work over SSH. See the full table
Security
From the firewall to SSH keys, read per server.
- E.01Details Server security centreRun a server security audit across the whole fleet without building the checklist by hand. One table shows the firewall, login protection, WAF, malware scanning and two-factor state of every server. Anything missing becomes a finding with the server’s name on it, and it closes itself once you fix it.
- E.02Details Server firewall managementManage the firewall on every server from one screen, whatever runs it: CSF (ConfigServer Firewall), Plesk Firewall, firewalld or ufw. The panel reads the engine from the server and works through it. You add rules, edit IP lists and block countries on CSF in one place, instead of learning a different command set on each machine.
- E.03This page Brute force protectionWatch failed login attempts and blocked IPs on every server from here, and unblock an IP when a customer locks themselves out. The screen follows the tool your panel already uses: cPHulk on cPanel/WHM, Fail2Ban jails on Plesk, Brute Force Monitor on DirectAdmin. Thresholds and the allow list sit on the same page.
- E.04Details WAF and malware scanner statusSee which WAF rule set and which malware scanner runs on each server: Imunify360, ModSecurity with OWASP CRS, Atomic Basic or ClamAV. A scanner that is installed but stopped shows up as a finding, and so does one that was never installed. For now the screen reports state; rule editing and manual scans are still being built.
- E.05Details Root password and SSH keysChange the root password from the panel without the password ever being stored. You see where it is kept, how many days ago it changed and who changed it. The sshd settings, including PermitRootLogin, password login and the SSH port, sit on the same page as the authorised SSH keys.
Connect your first server today.
Free for 14 days, no card needed. Create your account, add your first server with an API token or an SSH key, and the panel starts filling in a few minutes later.
No setup fee · Cancel anytime · EU-hosted