Keep your server safe
Turn on the firewall, fail2ban, malware scans, automatic updates and safer SSH logins.
Open a server's page and choose Security. Each tool has its own page. Anyone on your team can look. Only owners and admins can change them.
Firewall
The firewall blocks every port you don't list. SSH always stays open. Add the web ports, 80 and 443, if the server has websites. You can limit a port to some IP addresses.
After you save, ServerNest checks that it can still reach the server. If it can't, the old rules come back by themselves within about two minutes. The agent connects out, so it never needs an open port.
Fail2ban
Fail2ban blocks addresses that fail to log in too many times. It always watches SSH logins. You can also watch password-protected pages and bots looking for weak spots. You choose how many failed tries are allowed and how long a block lasts. You can unblock an address from the same page.
Add your own address to Addresses never to block if you might mistype a password.
Malware scans with ClamAV
ClamAV scans your apps' folders for known malware, once a day at a time you choose. You see how many files were scanned and which were infected. ClamAV only reports what it finds. It never deletes or moves your files. After launch, ClamAV is planned from the Pro plan. It needs about 1 GB of memory while it runs, so it can't be turned on for very small servers. Scans run at low priority, so your sites stay fast.
Automatic updates
Turn on automatic security updates and PHP fixes. You choose whether the server may restart by itself when an update needs it. The page shows when a restart is waiting.
SSH login settings
You can turn off password logins, so only SSH keys work, and turn off logins as root. Before you do, open a second SSH window and check that your key works. If something goes wrong, the old settings come back by themselves within two minutes. App SFTP logins use keys and are not affected.
Wazuh
Wazuh is a free, open-source security tool. After launch, it's planned for the Unlimited plan. ServerNest can install the Wazuh agent and connect it to your own Wazuh server. You can also install a Wazuh server on a spare machine with at least 4 GB of memory and 50 GB of free disk.
Wazuh watches your website folders and logs for attacks and changed files. Changed files that can run code are checked with ClamAV. Important alerts show on the Wazuh page, and an owner can choose who gets them by email. These checks run at most every 15 minutes and are kept light.