Defence in depth, managed from one panel
Four security layers protect every server: ModSecurity web application firewall with OWASP Core Rule Set, Fail2Ban intrusion prevention with tuned jails, UFW firewall with one-click service presets, and ClamAV antivirus with on-demand and scheduled scanning.
ModSecurity with OWASP Core Rule Set
SQL Injection (SQLi)
Blocks UNION/SELECT probes, boolean and time-based blind injection, stacked queries and comment-based evasion. Rules 942xxx — the single most exploited web attack class.
Cross-Site Scripting (XSS)
Blocks script tags, event handlers, javascript: URIs and encoded payload variants used to steal sessions or deface sites. Rules 941xxx.
Remote Command Execution (RCE)
Blocks Unix and Windows shell command injection: command chaining, subshells, wget/curl download-and-run patterns. Rules 932xxx.
Local/Remote File Inclusion
Blocks path traversal attacks, encoded traversal sequences and URLs smuggled into parameters that fetch attacker-hosted code. Rules 930xxx-931xxx.
PHP Code Injection
Blocks php:// wrappers, dangerous function calls (eval, system), serialized-object injection and variable-function tricks. Rules 933xxx.
Protocol Attacks
Blocks HTTP request smuggling, response splitting, header injection and malformed multipart uploads that poison caches or hijack sessions. Rules 921xxx–922xxx.
Java & Generic Injection
Blocks Java deserialization exploits, Log4Shell JNDI payloads, SSRF probes, Node.js prototype pollution and Ruby/Perl payloads. Rules 934xxx, 944xxx.
Web Shell Detection
Response-phase rules recognise output of known web shells (c99, WSO, b374k) — the safety net that catches an already-compromised site. Rules 955xxx.
Fail2Ban with tuned jails
SSH Brute-Force (protected)
Bans IPs that brute-force SSH logins. Aggressive mode catches pre-auth probes and protocol abuse. Always enforced, cannot be disabled.
Repeat Offenders
Watches Fail2Ban's own log for IPs banned again and again — receives a much longer ban (one week default). Stops persistent retry campaigns.
Apache/Nginx Login Abuse
Bans IPs that repeatedly fail HTTP Basic/Digest authentication on password-protected locations. Separate jails for Apache and Nginx.
Bad Bots & Script Probing
Bans known malicious crawlers, email-harvesting bots and IPs hunting for non-existent PHP/CGI scripts — the classic exploit scan pattern.
SMTP & IMAP Brute-Force
Bans IPs abusing Postfix (rejected deliveries, VRFY/RCPT scans, SASL login failures) and Dovecot (IMAP/POP3 brute-force).
Spam Flood (Rspamd)
Custom Speedy filter: bans senders whose messages are repeatedly rejected as spam by Rspamd. Catches bulk spam campaigns at the door.
FTP Brute-Force
Bans IPs that repeatedly fail FTP logins against ProFTPD. Protects file access credentials from online attacks.
Tunable per jail
Each jail supports custom bantime, findtime and maxretry overrides. Protected jails (SSH) cannot be disabled — only tuned.
UFW firewall management
One-click service presets
Instantly open ports for SSH, HTTP, HTTPS, HTTP/3 (QUIC), DNS, FTP, SMTP, IMAP, POP3 and MariaDB. Each preset expands into a standard rule.
Full rule management
Add allow/deny/reject/limit rules with port, protocol (tcp/udp/any), source address (any/IP/CIDR) and interface binding.
Lockout protection
Agent-side guards protect SSH port 22/tcp — the panel validates early for friendly errors, but the agent never allows you to lock yourself out.
Live status
Read the live UFW rule table synchronously from the agent. Every mutation flows through the audited SpeedyCTL job pipeline.
Logging levels
Configure UFW logging per rule (off/low/medium/high/full) with log-all mode for complete packet logging.
App profiles
Query UFW application profiles for installed services. Rules are validated against the agent's whitelist — never out of sync.
ClamAV scanning & quarantine
On-demand scanning
Launch manual scans of the hosting tree through the panel. Scans run as SpeedyCTL jobs with full progress logging.
Scheduled scanning
Configure automatic scan schedules using systemd OnCalendar syntax (e.g. "Mon *-*-* 03:00:00" for weekly Monday 3 AM).
Quarantine management
View quarantined files, inspect detection reports, delete individual items or clear the entire quarantine through the panel.
Signature updates
Trigger freshclam signature updates on demand. The panel shows current signature versions and last update timestamps.
HMAC-SHA256 chained audit logs
Every administrative action — job enqueue, security policy change, firewall rule modification, user creation — is recorded in a tamper-evident audit log. Each entry includes:
- Timestamp — UTC with microsecond precision
- Actor — user ID and IP address
- Tenant — multi-tenant context (which customer scope)
- Action — module and operation (e.g. "security.fail2ban_update")
- Result — success/failure with detail
- Previous/New Value — what changed
- HMAC-SHA256 Chain — each entry hashes the previous entry's signature, creating a tamper-evident chain
The chain lets you cryptographically verify that no log entry was modified or deleted after the fact. Compliance auditors can validate integrity without trusting the database.
Role-based access control
Four roles
SUPER_ADMIN (full platform control), ADMIN (server management), RESELLER (customer delegation), CUSTOMER (self-service). Each role has a fixed permission set.
Permission-based navigation
The interface adapts to each role. Administrators see only the servers and features they are authorised to manage. Navigation items hide automatically.
Tenant isolation
Multi-tenant architecture ensures customers only see their own resources. Resellers see their tenants. Staff see assigned servers.
Session security
HTTPS-only cookies, session regeneration on privilege change, CSRF tokens on every state-changing form. No passwords stored for SSH access.
Discuss your security requirements
Get in touch to understand how Speedy Hosting's security layers can support your compliance and protection needs.