Security
Security overview
NexPanel protects a server in layers, from the network down to each account.
| Layer | What it does | Docs |
|---|---|---|
| Firewall | nftables rules on every node: open ports, allow and deny lists, country blocking, connection-flood limits and blocking of repeated login failures | Firewall & WAF |
| NexShield | Watches web traffic and challenges, slows down or bans abusive clients and bots; IP reputation lists; AI bot controls | NexShield |
| WAF | ModSecurity with a rule set, per server and switchable per domain | Firewall & WAF |
| Malware scanner | NexScan scans accounts for web shells and injected code; quarantine and restore | Malware scanner |
| Account isolation | Each account runs as its own user in its own isolated view of the system | Account isolation |
| Resource limits | One account cannot exhaust the server | Resource limits |
| Mail limits | Hourly sending limits per mailbox; messages over the limit are held |
Panel security
- Staff roles (
admin,support,billing) and an audit log of every administrative change (Administration › Audit log). - The admin panel can be limited to your own addresses with
--admin-allowat install time. - Agents connect out to the controller with a node token; job payloads that contain secrets are encrypted at rest.
Release security
All releases are signed; installs and updates verify the signature first. See Verify a release and Updates.
Wrong or missing something? Let us know.