Advanced CloudPanel Security: Protect Your Data

CloudPanel is designed for VPS and Dedicated servers where security is paramount. Beyond basic access controls, CloudPanel offers advanced features: firewalls, WAF rules, SSL automation, API controls, and comprehensive audit logging. Understanding these features prevents data breaches and protects customer trust.

Advanced Security Overview

CloudPanel security layers:

• Network security: Firewall rules, DDoS protection, geographic blocking
• Application security: WAF (Web Application Firewall), rate limiting
• API security: Token authentication, IP whitelisting, rate limits
• Encryption: HTTPS enforcement, SSL automation, TLS 1.3
• Visibility: Audit logs, security events, anomaly detection

CloudPanel Firewall

Access CloudPanel firewall:

• CloudPanel → Security → Firewall Rules
• Define inbound/outbound rules by protocol, IP, port

Recommended firewall rules:

# Allow HTTPS from anywhere (customer access)
Inbound: Port 443, TCP, All IPs

# Allow HTTP, auto-redirect to HTTPS
Inbound: Port 80, TCP, All IPs

# Restrict SSH to office IP only
Inbound: Port 22, TCP, 203.0.113.42/32

# Restrict CloudPanel access
Inbound: Port 8338 (CloudPanel), 203.0.113.42/32 only

# Block known attack sources
Outbound blocks for malware IPs

Create IP whitelist for admin functions:

• CloudPanel → Security → IP Whitelist
• Add office/home IPs for SSH and panel access
• Everyone else sees "access denied"

Web Application Firewall

WAF blocks application attacks:

• SQL injection: Detects SQL in form inputs
• XSS (Cross-Site Scripting): Blocks JavaScript injection
• Path traversal: Prevents directory escape (/../../etc/passwd)
• RFI/LFI: Blocks local/remote file inclusion

Enable WAF in CloudPanel:

• CloudPanel → Website → Security → Enable WAF
• Set mode: "Block" (production) or "Log" (testing)
• Review blocked requests in Security → WAF Logs

Create custom WAF rules:

# Block requests containing "union select" (SQL injection)
Pattern: union.*select
Action: Block

# Block suspicious user agents
Pattern: bot|crawler|scanner
Action: Challenge (require JavaScript)

DDoS Protection

CloudPanel DDoS features:

• Rate limiting: Allow N requests per second per IP
• Connection limits: Max concurrent connections per IP
• Geographic blocking: Block entire countries if needed
• Bot detection: Challenge suspicious traffic

Configure rate limiting:

• CloudPanel → Security → Rate Limiting
• Set: 100 requests/minute per IP (adjust per site)
• Whitelist known APIs/services

Block specific countries:

• CloudPanel → Security → Geo-Blocking
• Block countries you don't serve
• Example: Block CN (China) if you only serve USA

API Security

If exposing CloudPanel API:

• Use API tokens, not passwords
• Rotate tokens every 90 days
• Whitelist API consumer IPs
• Enable API logging

Create API token:

CloudPanel → Security → API → Generate Token
# Token expires after 30 days by default

IP whitelist for API:

• CloudPanel → Security → API IP Whitelist
• Add only IP addresses that call your API

SSL Automation

Enable automatic SSL renewal:

• CloudPanel → SSL/TLS → Enable Auto-Renewal
• Let's Encrypt certificates auto-renew 30 days before expiry
• No manual renewal needed

Enforce HTTPS redirect:

• CloudPanel → Website → SSL → Force HTTPS
• All http:// requests redirect to https://

Enable HTTP/2 and TLS 1.3:

• CloudPanel → Website → SSL → Protocol Options
• Enable TLS 1.3 (30% faster, more secure)
• Disable old TLS 1.0, 1.1

Audit Logging

Monitor administrative actions:

• CloudPanel → Security → Audit Logs
• See all user logins, password changes, permission changes
• Detect unauthorized activity quickly

View login history:

CloudPanel → Security → Login History
# Shows IP, date/time, success/failure for each login

Set up alerts:

• Email notification on failed logins (3+ attempts)
• Alert on password changes
• Alert on new users added

Best Practices

• Principle of least privilege: Users get minimum permissions needed
• Regular reviews: Weekly audit logs, monthly permission review
• Separate staging/production: Test firewall rules on staging first
• Keep updated: CloudPanel security updates = critical
• Backup before changes: Test firewall rule changes on staging
• Monitor metrics: Track blocked requests, rate limits, DDoS events

Related: CloudPanel setup | Firewall setup | DDoS protection | SSL certificates

Related articles