Security Essentials

Use these essential checks after installing aaPanel and deploying a website. Complete the core steps first, then add extra protection only when needed.

Quick Checklist

Area	Do this
aaPanel	Strong password, two-factor authentication, private security entrance
Network	Only required ports; change the default SSH port; restrict panel and SSH access
Website	HTTPS, updates, safe file permissions
Data	Offsite backup; tested restore

Protect aaPanel

Open Settings -> Security.

• Enable a strong password and Google Authenticator.
• Keep the randomly generated security entrance private.
• Keep panel SSL enabled.
• Use BasicAuth or authorized IP access when the panel is exposed to the internet.
• Only change the panel port when needed. Open the new port in the provider's security group first.

See Panel Security settings.

Protect the Server

• Check both the cloud security group and the aaPanel firewall.
• Allow the aaPanel panel port, plus 80 and 443 for public websites, in both the cloud security group and aaPanel firewall.
• Changing SSH port 22 : Open the new port in the cloud security group and aaPanel firewall first.
• Restrict the panel and SSH ports to trusted IP addresses when possible.
• Use an SSH key for login. Enable brute force protection, or use Fail2ban, to block repeated failed logins.
• Keep the operating system, aaPanel, and installed services updated.
• You can also use System Hardening to lock SSH, users, services, and critical files.

See Firewall and SSH setup.

WARNING

When changing a port, firewall rule, or IP whitelist, open the new rule first. A wrong rule can lock you out of the server.

Protect the Website

• Deploy SSL and enable HTTPS.
• Enable WAF site protection and review the interception log.
• For Cloudflare or another CDN, enable the CDN option in WAF.
• Update PHP, the CMS, themes, and plugins.
• You can also use Tamper-proof for Enterprise to prevent file tampering and PHP Code Security to block webshells and malicious PHP code.
• Use 644 for files and 755 for directories; the owner should normally be www.
• Remote database access is disabled by default. Do not enable it unless required, and do not expose MySQL, Redis, or other internal ports to the internet.

See SSL, WAF, and PHP Security Update.

Protect Your Data

• Use Cron backup tasks to schedule website backups, database backups, and directory backups.
• Keep at least one backup copy outside the server.
• Test the restore process.
• Enable alarms for login changes, SSL expiration, resource usage, and service failures.
• Take a server snapshot before changing security plugins or kernel-level protection.

See Backup Restore and Alarm.

Before Enabling Protection

1. Create a server snapshot and keep an SSH recovery method available.
2. Add your own IP address and CDN origin IP addresses to the whitelist.
3. Enable one protection at a time and verify that the website and panel still work.
4. Do not run multiple plugins with overlapping rules without reviewing their compatibility.

Additional Protection

After the essential checks, add protection based on the website's risk. Install only what is needed.

Protection	Key benefit
Nginx WAF	Adds advanced attack filtering for Nginx
Tamper-proof for Enterprise	Stops unauthorized changes to website pages and files
File Monitor	Monitors file changes and detects Trojans
System Hardening	Locks down SSH, users, services, and critical files
PHP Code Security	Blocks webshells and malicious PHP behavior
Anti-intrusion	Blocks attacks launched through websites, Redis, and MySQL
Network Threat Detection	Detects suspicious inbound and outbound connections for investigation
Apache WAF	Adds advanced attack filtering for Apache
Fail2ban	Blocks repeated failed logins and abusive IPs
ClamAV	Finds and quarantines viruses and malware

Compatibility

• Tamper-proof for Enterprise cannot run with Website Tamper-proof or other anti-tamper software. If the system is not supported, use Website Tamper-proof instead.
• System Hardening can block software installation and startup changes. Enable it only after the environment is fully configured.

If You Suspect an Attack

1. Check the website access log and error log.
2. Review WAF interception records and Fail2ban records.
3. Review SSH login logs.
4. Change exposed passwords, take a snapshot, and scan the website files with ClamAV before deleting anything.

See Site Related FAQ and Defend Against Website Attacks.