Security

Signing in

• Passwords must be at least 12 characters; common and leaked passwords are refused.
• Two-factor authentication: an authenticator app (TOTP) or a passkey (Face ID, Touch ID, Windows Hello, a security key). Passkeys can also replace the password entirely. Keep the recovery codes shown when you turn 2FA on.
• An administrator can require 2FA for everyone in the organization.
• Adding or removing a factor asks for your password or a code again, and you get an e-mail about it.
• After 10 wrong second factors in a day, the account’s second factor is locked for 15 minutes (longer if it happens again), and you are told by e-mail.
• Sessions: see where you are signed in and sign out other devices from your own security page.
• Repeated failed sign-ins from one network are banned for 15 minutes.

Sites: the web application firewall

Every site can run behind a WAF (Coraza with the OWASP Core Rule Set) in one of three modes: off, detect (log only) or block. New sites start in your organization’s default mode. You can raise the paranoia level, exclude a rule for a path when it blocks something legitimate, and add security headers (including a Content-Security-Policy). Blocked and detected requests appear in the site’s WAF log for 30 days.

Servers: firewall, countries and bans

• Firewall rules per server, and country rules for HTTPS and SFTP (allow only some countries, or block some), based on the DB-IP Lite country database. Mail services can have their own rules.
• Brute-force protection bans an address after repeated failed logins, for example to SFTP or mail. Bans are listed in the panel and can be lifted by hand; an IPv6 ban covers the whole /64 network.

The audit log

Every action in the panel and the API is written to an audit log that the panel’s own database account cannot rewrite. Each entry is chained to the previous one with a hash, and a signed daily anchor is stored on write-once storage for seven years; a change made directly in the database is detected and raised as an alert. Your organization can search its log and export it (CSV or JSON). IP addresses in the log are shortened to their network after 90 days.

OS and dependencies

PlusPanel OS and the agent are patched by us; see OS security updates. WordPress sites are checked every day for vulnerable plugins and planted files; see WordPress security scanning.

Reporting a vulnerability

Write to ops@pluspanel.net with “security” in the subject.