Security Advisor

Free plugin. It looks at the settings and the state of the server, lists what could be hardened, and links each finding to the page that fixes it. Think of it as a checklist that fills itself in.

Where it is

Security Center → Security Advisor in the Host Manager. Root only. Resellers do not see it.

The page opens with the result of the last scan and the time it was made. If no scan has been made yet, it runs one on first open. Press Scan Again to run all the checks now. Each scan is also written to the activity log with the counts.

Reading the result

At the top, four counters: Critical (red), Warnings (orange), Notes (blue) and Passed (green). Below, one table with a status badge for each check, the check's name, what was found and a button that opens the page where you fix it, such as Fix it, Manage Hooks or Brute Force Protection. The worst findings are first.

A check is either fine (it shows the good text and counts as Passed) or it shows its problem text with its severity. A Note is advice, not a fault. For example, a server on the Demo driver gets a note that changes are only recorded, and a server with no blocked IP addresses simply reports the count.

What it checks

Version 1.0.0 runs 27 checks, in these groups:

• Sign-in and passwords: brute force protection on; two-factor sign-in for root, for resellers and for hosting accounts; required password strength (50 or more); how old the root password is; failed sign-ins in the last 24 hours (a warning at 50).
• Panel and PHP: the panel runs over HTTPS; the panel's PHP is 8.1 or newer; display_errors and expose_php are off; the panel's secret key is not the default and has 16 characters or more; security tokens in addresses are required.
• API and hooks: API tokens without an expiry date; hooks that run scripts.
• Accounts: accounts with shell access; accounts over their disk quota; domains without an installed certificate.
• Services and mail: the core services are running; service monitoring is on; the panel cron ran in the last ten minutes; the mail queue holds no more than 100 messages; the number of blocked IP addresses.
• Backups: scheduled backups are on; the newest backup is recent.
• Licence: the licence is valid.
• Server: the driver in use (Linux or Demo).

Each check has a one-line fix text and, where there is a page for it, a link.

Using it well

1. Run it after the wizard, before the first customer.
2. Fix the red items first: they are the things that let an attacker in or leave you without backups.
3. Decide on the notes. A note you accept, such as blocked IP addresses, is not a problem to fix.
4. Run it again after a change, and once a month.

The Security Advisor does not change anything by itself; it only reads settings. Each fix is a normal page in the Host Manager, for example Security Center → Brute Force Protection or Tweak Settings → Security.

What it cannot see

It checks the panel and its settings, not the whole machine. It does not scan the files of customers (that is the premium Malware Scanner, see Malware Scanner), does not review firewall rules (see Firewall Manager) and does not know about software you installed outside the panel. Keep the operating system updated with Software → System Update.

For developers

The plugin builds its list in plugins/security-advisor/lib.php. Each check returns an id, a title, ok or not, a severity, the two texts and an optional fix page. The last result is kept in the setting secadv_last.