aaPanel security hardening checklist

aaPanel gives you significant control over your VPS. A compromised panel means full server access. These hardening steps reduce your attack surface and should be completed on every new aaPanel deployment.

Panel access security

Change the default panel port and path:

aaPanel's default port (8888) and path are publicly known. Change both to something non-obvious:

1. Go to aaPanel → top right corner → Panel Settings
2. Change the panel port to a random 5-digit number (e.g., 47291)
3. Change the panel path to a random string (e.g., xk7m2p)
4. Open the new port in the firewall before saving
5. Save-your new panel URL is http://IP:47291/xk7m2p

Change the default admin password:

1. Log in to aaPanel → top right → Change Password
2. Set a strong password of at least 16 characters

Enable SSL for the panel itself:

Once you have a domain pointing to the server, enable SSL for the panel: aaPanel → Panel Settings → SSL certificate → issue a Let's Encrypt certificate for the panel domain. This makes the panel URL HTTPS and encrypts your admin credentials in transit.

SSH hardening

aaPanel's Security section includes basic SSH settings. Recommended:

• Disable root password login: Edit /etc/ssh/sshd_config and set PermitRootLogin prohibit-password
• Use SSH key authentication: Add your public key to /root/.ssh/authorized_keys then set PasswordAuthentication no
• Change SSH port: From the default 22 to a non-standard port. Update the firewall rule to match
• Restart SSH after changes: systemctl restart sshd

Fail2Ban

Fail2Ban monitors log files and automatically blocks IPs that show repeated failed authentication attempts (SSH, FTP, panel login).

Install via aaPanel App Store or SSH:

apt install fail2ban -y    # Ubuntu/Debian
systemctl enable fail2ban
systemctl start fail2ban

aaPanel's Security section also includes a built-in brute-force protection feature for the panel-enable it in Security settings to limit panel login attempts per IP.

PHP security settings

In the PHP configuration for each version (aaPanel → App Store → PHP X.X → Settings → php.ini):

• Set display_errors = Off-never show PHP errors to web visitors
• Set log_errors = On and configure error_log to a writable path
• Set expose_php = Off-hides the PHP version from HTTP response headers
• Consider disabling dangerous functions: disable_functions = exec, passthru, shell_exec, system, proc_open (verify your applications do not need these first)

File permissions

Correct file permissions prevent web-accessible files from being executed as scripts or modified by the web server process:

• Directories: 755
• PHP and HTML files: 644
• wp-config.php: 640 or 600
• No files or directories should be set to 777

You can fix permissions recursively via SSH:

find /www/wwwroot/yourdomain.com -type d -exec chmod 755 {} \;
find /www/wwwroot/yourdomain.com -type f -exec chmod 644 {} \;

Keep software updated

• Update the OS packages regularly: apt update && apt upgrade -y
• Update aaPanel itself when new versions are available-see How to update aaPanel safely
• Keep PHP versions, Nginx/Apache, and MySQL updated through the aaPanel App Store
• Keep WordPress core, themes, and plugins up to date on every site

Quick checklist

• ☐ Panel port changed from default
• ☐ Panel path changed from default
• ☐ Strong admin password set
• ☐ SSL enabled for the panel
• ☐ Root SSH password login disabled-key-based only
• ☐ SSH port changed from 22
• ☐ Fail2Ban installed and active
• ☐ display_errors = Off in PHP config
• ☐ File permissions correct (755 dirs / 644 files)
• ☐ Firewall rules reviewed-close ports not in use
• ☐ MySQL port 3306 not open to all IPs
• ☐ OS packages updated
• ☐ Backups created and stored off-server

Related: Configure firewall rules in aaPanel | How to update aaPanel safely | SSH hardening and key management | Secure a website from hacking | Creating and managing secure passwords

Related articles