Security Dashboard

⭐

Ubuntu Pro is not registered — it's free for this server

Ubuntu 24.04.4 LTS without Pro has 5-year standard security coverage. Ubuntu Pro extends this to 10 years (34) and adds features that matter for a production WordPress server. Free for up to 5 machines at ubuntu.com/pro.

🔄

Livepatch

Kernel security patches applied live — no reboots, zero downtime

🛡️

Extended patching

23,000+ packages covered vs ~2,300 in standard Ubuntu

🔒

USG / CIS hardening

Automated CIS benchmark profiles via ubuntu-advantage enable usg

At a glance

7/8

Services

7 of 8

Active bans

fail2ban + CrowdSec

39%

Disk used

/ (root)

52%

RAM used

3119 / 5926 MB

Clean

Malware

All scans clean

0 0

Pending updates

0 0 pending

Service health

🔥

UFW

● active

🚫

fail2ban

● running

🛡️

CrowdSec

● running

⚡

CS Bouncer

● running

🦠

ClamAV

● running

🔄

Freshclam

● running

🌐

NGINX

● running

🗄️

MariaDB

● stopped

Hardening status

✓

UFW Firewall

22 · 80 · 443 · 8443

SSH Hardened

Key-only · no root pw · max 3 tries

NGINX Security Blocks

xmlrpc · wp-config · upload exec · user enum · autoindex off

NGINX Security Headers

X-Frame-Options · X-Content-Type · Referrer-Policy · server_tokens off

✓

PHP Hardened

expose_php off · all FPM versions

✓

PHP Site Isolation

open_basedir + tmp/session per site

✓

WordPress Hardening

DISALLOW_FILE_EDIT · salts rotated

WP mu-plugin

Pingback removed · REST headers · CSP

MySQL Secured

Anon users removed · remote root off

✓

/dev/shm noexec

nosuid · nodev · noexec

Firewall

fail2ban Jails

7 jails active · ban 1 hour · recidive 7 days

Jail	Banned now	Total	Failed
nginx-botsearch	0	0	0
nginx-http-auth	0	0	0
nginx-limit-req	0	0	0
recidive	0	0	2
sshd	0	6	0
wordpress-login	0	11	0
wordpress-xmlrpc	1	5	0

UFW Rules

7 ports open · default deny incoming

22/tcp

ALLOW IN Anywhere

SSH

443

ALLOW IN Anywhere

HTTPS

443/tcp

ALLOW IN Anywhere

HTTPS

443/udp

ALLOW IN Anywhere

443/udp

80/tcp

ALLOW IN Anywhere

HTTP

8433:8443/tcp

ALLOW IN Anywhere

8433:8443/tcp

8443/tcp

ALLOW IN Anywhere

CloudPanel

Default policy

DENY incoming ALLOW outgoing

Recent bans

1 currently banned

Intrusion detection — CrowdSec

Active Decisions

Port 8081 · iptables active

No active decisions

Configuration

LAPI endpoint	127.0.0.1:8081
Bouncer type	iptables active
Log acquisition	/home/*/logs/nginx/ + auth.log
Collections installed	11

Collections

11 installed

✔crowdsecurity/base-http-scenarios

✔crowdsecurity/http-cve

✔crowdsecurity/linux

✔crowdsecurity/magento

✔crowdsecurity/mariadb

✔crowdsecurity/mysql

✔crowdsecurity/nginx

✔crowdsecurity/postfix

✔crowdsecurity/sshd

✔crowdsecurity/whitelist-good-actors

✔crowdsecurity/wordpress

Malware protection

ClamAV

Always-on daemon · scanning /home

Version	ClamAV 1.5.3
Scan mode	Always-on daemon
Signatures	28057
Signatures updated	Sat Jul 11 08:24:05 2026
Last scan result	Pending — no scan recorded yet
Max file size	200 MB
Max scan size	400 MB

maldet

Linux Malware Detect · ClamAV engine · quarantine on detect

Version	v1.6.6
Engine	ClamAV
Last scan	unknown
Last scan result	Clean ✓
Action on detect	Quarantine + clean
Full scan schedule	Sunday 00:00 UTC
Daily scan schedule	Mon–Sat 01:00 UTC

System

Operating System

Runtime state at last refresh

OS	Ubuntu 24.04.4 LTS
Kernel	6.8.0-31-generic
Uptime	28 weeks, 23 hours, 56 minutes
Load average	0.75 · 0.23 · 0.08

Resources

RAM3119 / 5926 MB — 52%

Disk (/)39% used

MySQL buffer poolMariaDB not running

MySQL connectionsMariaDB not running

Redis memory12 MB used (no maxmemory set)

CloudPanel & Maintenance

Automated schedule — no action needed

CloudPanel	unknown
Pending OS updates	0 0 — 0 0 pending
unattended-upgrades	Active — security patches
needrestart	Inactive

Weekly schedule (UTC)

maldet full scan	Sun 00:00
ClamAV scan (cron mode)	Daily 02:00
OS full upgrade	Sun 03:00
CloudPanel update	Sun 04:00
Security re-run	Sun 05:00
Dashboard refresh	Daily 06:00 & 18:00

How the layers work together

🌍

Browser

Visitor request

→

☁️

Cloudflare

WAF · DDoS · CDN · Cache

Cache EverythingWAF On

→

⚙️

NGINX

CloudPanel CE

Security blocks

→

🔷

WordPress

PHP-FPM

Wordfence WAF

Data layer (WordPress ↓)

⚡

Redis

Object cache
DB query results

🗄️

MariaDB

Database
Slow query log on

Cloudflare configuration

Settings

Dashboard → yourdomain.com → each section below

SSL/TLS mode

SSL/TLS → Overview

Full (Strict)

Always Use HTTPS

SSL/TLS → Edge Certificates

Cache Everything rule

Caching → Cache Rules

Browser Cache TTL

Caching → Configuration

Respect headers

Rocket Loader

Speed → Optimization — breaks WordPress JS

Off

Auto Minify

Speed → Optimization — conflicts with server-side

Off

Crawler Hints

Caching → Configuration

Cache Bypass Rules

Caching → Cache Rules → bypass rule for each URL. These pages must never be served from cache.

✕/wp-admin/*WordPress admin

✕/wp-login.phpLogin page

✕/cartWooCommerce cart

✕/checkoutWooCommerce checkout

✕/my-account/*WooCommerce account

✕/?wc-ajax=*WooCommerce AJAX

✕/?s=*Search results

Varnish cache — which scenario applies to you

Using Cloudflare Cache (recommended)

Disable Varnish in CloudPanel

Cloudflare serves cached pages from 300+ global PoPs. Varnish adds server-side cache pressure for no benefit — Cloudflare never reaches origin for cached responses. Two caches with independent TTLs causes stale-content confusion.

How to disable

1. CloudPanel → Varnish Cache

2. Toggle Varnish Cache off for each site

3. Or disable globally in server settings

Not using Cloudflare Cache

Use CloudPanel's Varnish Cache plugin

If Cloudflare is DNS-only (grey cloud) or not in use, Varnish provides useful origin-level full-page caching. Install the CloudPanel Varnish Cache plugin per site.

Setup

1. CloudPanel → Varnish Cache → Enable

2. Install CloudPanel Varnish Cache WP plugin per site

3. Configure TTL and exclusion rules in the plugin

Required WordPress plugins

⚡

Redis Object Cache

Free · wordpress.org

Connects WordPress to the Redis instance already running on your server. Caches database query results, WordPress options, and transients in memory — dramatically reducing database load on every page request.

Works alongside Cloudflare page caching — not redundant
Eliminates repeated identical DB queries within a request
Critical for WooCommerce — cart, session, and option lookups
Enable in plugin Settings → Enable Object Cache

⚠ Do not enable LiteSpeed Cache's built-in object cache — use Redis Object Cache plugin instead. Both active causes conflicts.

🛡️

Wordfence

Free tier · wordpress.org

Application-layer WAF that inspects PHP requests before WordPress processes them. Complements Cloudflare's network-layer WAF — Cloudflare blocks volumetric attacks; Wordfence catches application-specific exploits that reach origin.

WAF rules updated for newly disclosed WP plugin CVEs
Malware scanner checks core files, themes, and plugins
Login security — brute force protection, 2FA option
Live traffic log — useful for debugging blocked requests

⚠ Disable Wordfence's Falcon Engine caching — it conflicts with Redis Object Cache and is redundant when Cloudflare handles page caching.

Do not use — page caching plugins

These conflict with Cloudflare's page cache

Page caching is handled at Cloudflare's edge. Using a WordPress-level page cache alongside Cloudflare creates two independent TTL clocks, stale content on origin, and confusing double-purge behaviour.

W3 Total Cache

Page + object + DB cache — complex config, frequently causes white screens

WP Super Cache

Writes static HTML to disk — redundant when Cloudflare serves from edge

WP Rocket

Page cache conflicts with Cloudflare Cache Everything — disable page caching if using for minification or lazy load

LiteSpeed Cache

Designed for LiteSpeed servers — page cache and object cache both conflict on NGINX/CloudPanel

Hummingbird

Page cache conflicts with Cloudflare; redundant over the recommended stack

Comet Cache / Zencache

Writes full-page HTML to disk — same redundancy as WP Super Cache

Recommended Stack