🛡️
Security in every layer
OrbixPanel is built as defense-in-depth: independent, overlapping layers from the network edge down to your data. If one control is bypassed, the next still stands. Most layers ship in every edition; the advanced Security Suite (WAF, malware scanning, Spam Guard) is included in Professional.
Layer 1
🧱
Network & perimeter
Stop unwanted traffic before it reaches your services.
- ✓Managed firewall (UFW) with a one-click rule editor
- ✓Exposed-port audit — flags databases/caches left open to the internet
- ✓Intrusion prevention (Fail2ban) with auto-ban of brute-force IPs + attacker analytics
- ✓Per-endpoint rate limiting to blunt abuse and floods
Built on UFW ↗, Fail2ban ↗
Layer 2
🔒
Encryption in transit
Everything served over HTTPS, always current.
- ✓Free automatic SSL/TLS (Let’s Encrypt) with auto-renewal
- ✓Certificate expiry monitoring + alerts (expired cert = outage, avoided)
- ✓Force-HTTPS and modern TLS defaults
Built on Let's Encrypt ↗, Certbot ↗
Layer 3
🛡️
Application defense
Block the OWASP-style attacks that target web apps.
- ✓Web Application Firewall (WAF)Professional
- ✓XSS-safe rendering (all dynamic output escaped) + strict input validation
- ✓Scoped API tokens + role-based access control
- ✓Safe DNS record validation (no malformed/dangerous zone edits)
Layer 4
🦠
Malware & content
Catch and contain malicious files and spam.
- ✓Malware scanner with scheduled scans + quarantineProfessional
- ✓Spam Guard for inbound mailProfessional
- ✓Isolated per-tenant file scopes
Layer 5
✉️
Email trust
Prove your mail is really yours — and keep it out of spam.
- ✓SPF, DKIM & DMARC setup and one-click validation
- ✓Deliverability analyzer that flags weak/missing records
Built on Postfix ↗, OpenDKIM ↗
Layer 6
🔑
Accounts & access
Make stolen passwords useless.
- ✓Two-factor authentication (TOTP) with downloadable backup codes
- ✓Password-strength enforcement
- ✓SSH key management + password-login lockdown
- ✓Signed install/heartbeat (HMAC) + single-use install tokens
Layer 7
🏢
Data & tenant isolation
One tenant can never reach another’s data.
- ✓Query-scoped multi-tenancy + per-tenant Unix/FPM isolation
- ✓Redacted, opt-in crash telemetry (never leaks secrets/PII)
- ✓Automated backups & disaster recovery
Built on restic ↗
Layer 8
📈
Visibility & response
See threats and act fast.
- ✓Security posture score across firewall, certs & runtimes
- ✓Ban/attack analytics, log explorer & real-time alerts
- ✓End-of-life runtime detection (e.g. outdated PHP)
Attacks we stop
Each common attack is countered by one or more layers — that overlap is the point.
| Attack | How OrbixPanel defends |
|---|---|
| Brute-force & credential stuffing | Fail2ban auto-ban + rate limiting + mandatory 2FA |
| Stolen / phished passwords | Two-factor auth with backup codes |
| Man-in-the-middle / eavesdropping | Automatic HTTPS (Let’s Encrypt) everywhere |
| Malware uploads | Malware scanner + quarantine |
| Spam & phishing mail | Spam Guard + SPF/DKIM/DMARC |
| Email spoofing of your domain | SPF, DKIM & DMARC with validation |
| XSS & injection | Escaped rendering + strict input/DNS validation + WAF |
| Exposed databases / services | Firewall + exposed-port audit |
| API abuse | Scoped tokens + HMAC-signed calls + single-use install tokens |
| Cross-tenant access | Query-scoped isolation + per-tenant OS sandboxing |
| Privilege escalation | RBAC + least-privilege sudo path-jails |
| Outdated, vulnerable software | EOL runtime detection + one-click updates |