Site Security

The Security page collects every protection for a single site in one view: certificate status, malware scanning, vulnerability reports, login hardening, country filtering, hotlink protection, and an IP block list. This guide walks through each card and what to do with it.

Where Security Lives in KPanel

How you reach it depends on what kind of site it is:

Sign in to KPanel.
Click Websites in the left sidebar, then click the site.
For a WordPress or WooCommerce site, open WordPress, then Security. For a static, PHP, Node.js, Python, or Ruby site, open Advanced, then Security.

Either route lands on /websites/<site-id>/security.

Security page for a site in KPanel

The Protections Summary

At the top, a single line reads how many of your protections are active, with a pill per check. The checks are your certificate, malware status, login protection, and vulnerabilities, and each pill is green when healthy and amber when it needs attention.

Use it as a glance test. If every pill is green, nothing on this page needs you today.

SSL Certificate

The certificate card shows days remaining, the subject, the issuer, the expiry date, and every domain the certificate covers. The days-remaining pill turns amber and then red as expiry approaches.

Certificates renew automatically. The Renew now button is there for the case where automatic renewal has failed, usually because DNS changed or a domain on the certificate no longer resolves to the site.

Two hardening switches sit underneath:

HSTS tells browsers to always use HTTPS for the domain, which protects against downgrade and stripping attacks.

HSTS is remembered by the browser for a long time and cannot be withdrawn from a visitor who has already seen it. Only enable it once you are certain every part of the site, including every subdomain you serve, works correctly over HTTPS. Enabling it on a site with mixed HTTP content will break things you cannot unbreak remotely. See Fixing Mixed Content Warnings first.

OCSP stapling makes TLS handshakes faster and more private by having the server supply the certificate's revocation status itself. There is no downside to leaving it on.

For certificates generally, see SSL Certificates.

Malware Scan

Scans run automatically every night. The card shows the result of the most recent scan, a scan history, and a Scan now button for an on-demand run, which polls until it finishes.

When the site is clean, the card says so with the number of files scanned and the completion time.

When files are infected, each one is listed with its path and the threat name, on a red background. Some are labelled Auto-quarantined, which means the file has already been neutralised for you. For the rest, a Quarantine button moves the file out of the way.

Quarantining a file removes it from your site. If the infected file is a legitimate part of a theme or plugin that has been modified, quarantining it can break the site. Take a backup before you quarantine anything, so you have a route back. See Taking a Backup.

Finding malware means something got in. Cleaning the files is only half the job: change your passwords, update everything, and work out how the attacker got there, or you will be back next week.

Automatic quarantine is a plan entitlement included with Managed WordPress. On other plans, detection still runs and you quarantine manually.

Vulnerability Scan

The vulnerability card lists known security issues in your WordPress core, themes, and plugins, checked daily against a CVE database.

Each finding shows a severity pill, the component and its version, the CVE identifier where there is one, the title, the version it is fixed in, and when it was first seen. A Dismiss button hides a finding you have assessed and accepted.

Toggle resolved in the card header to see issues that have been fixed, each with the date it resolved.

The Fixed in line is the actionable part: it tells you the exact version to update to. Most findings are closed by updating the component. See WordPress Updates.

Vulnerability scanning is a plan entitlement included with Managed WordPress. On other plans the card is replaced by a panel describing the feature with a link to upgrade.

Login Brute-Force Protection

This card monitors sign-in attempts against your WordPress login and bans the sources that fail repeatedly. An address with five or more failed attempts in ten minutes is blocked automatically for an hour.

Five counters show currently banned addresses, addresses being watched but not yet banned, the total blocked since the service last restarted, the total failed attempts, and recent login requests. Currently banned addresses are listed underneath.

High numbers here are normal and are not a sign that anything is wrong. Every public WordPress site is probed constantly. What matters is that the ban count is rising, which means the protection is working.

Login hardening is a plan entitlement included with Managed WordPress. Where it is not available, the card does not appear.

Country IP Filtering

A summary card shows whether country filtering is active and how many countries are being blocked or allowed. Click Configure to open the full country picker.

Country filtering is a coarse filter, not a boundary. Anyone on a VPN appears to be somewhere else. The full guide, including the safety guard around allow-only mode, is in Country Blocking for a Site.

Hotlink Protection

Hotlink protection stops other websites embedding your images and media directly, which otherwise consumes your bandwidth to serve someone else's page.

Turn it on with Turn on. Direct visits, search engines, and your own pages keep working normally.

Once it is on you can add allowed domains, one at a time, in the form example.com or *.example.com. Your own domains are always allowed automatically, so the list is only for partner sites that legitimately embed your media. Remove an entry with the small cross beside it.

IP Block List

The block list denies specific addresses or CIDR ranges outright.

Enter an IP address or CIDR range.
Optionally add a reason, which is worth doing so future-you knows why it is there.
Click Block.

Each entry is listed with its reason and a bin icon to remove it.

This is the precise tool. When you know exactly which address is causing a problem, block it here rather than blocking its whole country.

PCI-DSS Hardening

On managed WooCommerce stores, an extra card offers hardening aimed at SAQ-A eligibility. It shows four checks and whether each is currently applied:

The WordPress file editor is disabled.
File modifications from the admin are prevented.
SSL is forced for admin sessions.
XML-RPC is blocked at the web server.

Apply all hardening turns them on, and Remove hardening reverses them.

Disabling file modifications also prevents installing or updating plugins and themes from inside the WordPress admin. That is the point, but it will change how you work. Plan your update process before you apply it. See WordPress Plugins.

Applying these settings is a useful step toward PCI-DSS SAQ-A, not a certification. Your payment flow and your own practices determine your actual eligibility.

A Sensible Routine

Weekly: glance at the protections summary. Act only if a pill is amber.
When a vulnerability appears: update the named component to the version listed under Fixed in.
Before any risky change: take a backup.
On a certificate warning: check that DNS still points at the site, then use Renew now.
After any suspected compromise: run a manual malware scan, change every password, and update everything.

Password-Protecting a Site for a genuine access boundary.
Country Blocking for a Site for geography-based filtering.
Two-Factor Authentication for your Kapsule account itself.
Taking a Backup before you change anything on this page.