Security

Harden the box and keep attackers out. Security is layered — do all of these.

Firewall

Firewall controls which ports are open.

• Keep only what you need open: typically 22 (SSH), 80/443 (web), mail ports if you host email, and the panel port.
• Add allow/deny rules; close everything else.
• Prefer restricting SSH to known IPs where practical.

Fail2ban

Fail2ban bans IPs that show abusive patterns (repeated failed SSH/web logins).

• Enable the jails you need (SSH, web auth, mail).
• Review banned IPs; unban false positives.
• Tune ban time and retry thresholds for your traffic.

Malware scanner

Malware Scan inspects web roots for known-bad files and patterns.

• Run an on-demand scan or schedule regular scans.
• Review findings and quarantine/remove confirmed threats.
• Especially valuable on shared boxes and CMS sites (WordPress).

SSH keys

SSH Keys manages authorized keys for server access.

• Add your public key and prefer key-only auth; disable password SSH once keys work.
• Remove keys for people who no longer need access.

Two-factor authentication (2FA)

Turn on 2FA for panel logins (admins and tenants). It’s the single highest-impact step against credential theft — enable it when prompted and require it for all admins.

Also keep the panel and OS updated (System & services → Updates); unpatched software is the most common way in.

Third-party vulnerabilities

Beyond the OS, the software your sites depend on (PHP, nginx, MySQL…) gets its own critical fixes. OrbixPanel tracks these as Security Advisories, tells you which of your installed versions are affected, and upgrades them in one click — see Patch a vulnerability (Security Advisories).