Security Guide

HPanel includes a comprehensive security stack that protects your server and hosted accounts.

Malware Scanning

• Realtime scanning — File upload hooks and filesystem watchers detect malicious files immediately
• ClamAV integration — Scans with ClamAV signatures plus custom detection rules
• Auto-quarantine — Detected threats are moved to quarantine automatically
• Scan scheduling — Run full server scans on a schedule

Brute Force Protection

• Fail2Ban — Monitors SSH, FTP, mail, and web login attempts
• IP Blocker — Manually block IPs or ranges from the admin panel
• Rate Limiting — API and login endpoints are rate-limited

SSL / TLS

• Free Let's Encrypt SSL certificates issued and renewed automatically
• TLS 1.2+ enforced by default
• HSTS headers configurable per domain

Email Security

• SPF records configured automatically per domain
• DKIM signing enabled by default
• DMARC policy configurable per domain

Code Protection

• HPanel backend is deployed as obfuscated dist-only packages
• No raw source code on production servers
• Control flow flattening and string encryption