CyberPanel is an open-source web hosting control panel built on OpenLiteSpeed (or LiteSpeed Enterprise) with integrated WordPress management. As a panel that manages websites, databases, DNS, and email services, it requires comprehensive security hardening to protect both the server and hosted applications.
CyberPanel supports TOTP-based 2FA for admin and reseller accounts. Enable it immediately after installation.
Enable 2FA via CyberPanel UI:
Force 2FA for all users via CLI:
# Login to CyberPanel server
cd /usr/local/CyberCP
# Enable 2FA enforcement (requires CyberPanel 2.2+)
python3 manage.py shell
>>> from login.models import Admin
>>> Admin.objects.update(force_2fa=True)
>>> exit()
Change default admin credentials immediately:
# Reset admin password via CLI
cd /usr/local/CyberCP
python3 manage.py changepassword admin
Best practices:
Create new admin user:
cd /usr/local/CyberCP
python3 manage.py createsuperuser
# Follow prompts for username, email, password
Restrict panel access by IP:
# Using iptables
sudo iptables -A INPUT -p tcp --dport 8090 -s 10.0.0.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 8090 -j DROP
sudo iptables-save > /etc/iptables/rules.v4
# Using firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/24" port port="8090" protocol="tcp" accept'
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" port port="8090" protocol="tcp" reject'
sudo firewall-cmd --reload
# Using UFW
sudo ufw allow from 10.0.0.0/24 to any port 8090
sudo ufw deny 8090
Configure via CyberPanel:
Configure session settings in /usr/local/CyberCP/CyberCP/settings.py:
# Session timeout (seconds) - default 15 minutes
SESSION_COOKIE_AGE = 900
# Secure cookies (HTTPS only)
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True
# HTTP-only cookies (no JavaScript access)
SESSION_COOKIE_HTTPONLY = True
CSRF_COOKIE_HTTPONLY = True
# SameSite protection
SESSION_COOKIE_SAMESITE = 'Lax'
Restart CyberPanel after changes:
systemctl restart lscpd
CyberPanel uses OpenLiteSpeed for its web interface. Always use valid SSL certificates.
Option 1: Auto-generate self-signed certificate (default)
# CyberPanel creates self-signed cert during installation
# Located at: /usr/local/lsws/conf/cyberpanel.crt
# Located at: /usr/local/lsws/conf/cyberpanel.key
Option 2: Let’s Encrypt certificate (recommended)
# Install via CyberPanel UI
# Websites → List Websites → Issue SSL for your panel domain
# Or manually via certbot
sudo apt install certbot # Debian/Ubuntu
sudo certbot certonly --standalone -d cyberpanel.example.com
# Link certificates
sudo cp /etc/letsencrypt/live/cyberpanel.example.com/fullchain.pem /usr/local/lsws/conf/cyberpanel.crt
sudo cp /etc/letsencrypt/live/cyberpanel.example.com/privkey.pem /usr/local/lsws/conf/cyberpanel.key
sudo chmod 600 /usr/local/lsws/conf/cyberpanel.key
# Restart OpenLiteSpeed
systemctl restart lscpd
Force HTTPS redirect:
# CyberPanel UI → Security → Force HTTPS Redirect
# Or edit OpenLiteSpeed configuration
Configure secure cipher suites (/usr/local/lsws/conf/httpConfig.conf):
sslCiphers TLSv1.3:TLSv1.2:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
sslProtocols TLSv1.2 TLSv1.3
sslHSTS on
sslHSTSMaxAge 31536000
Hide server version:
# In OpenLiteSpeed Admin Console
# Configuration → Security → Hide Server Header = Yes
Configure security headers:
# /usr/local/lsws/conf/httpConfig.conf
headers {
add Strict-Transport-Security "max-age=31536000; includeSubDomains"
add X-Content-Type-Options "nosniff"
add X-Frame-Options "SAMEORIGIN"
add X-XSS-Protection "1; mode=block"
add Referrer-Policy "strict-origin-when-cross-origin"
add Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';"
}
Default CyberPanel ports:
| Port | Service | Required |
|---|---|---|
| 8090 | CyberPanel UI | Yes |
| 80 | HTTP | Yes |
| 443 | HTTPS | Yes |
| 21 | FTP | Optional |
| 22 | SSH | Recommended |
| 25 | SMTP | If mail enabled |
| 53 | DNS | If DNS enabled |
| 110/995 | POP3 | If mail enabled |
| 143/993 | IMAP | If mail enabled |
Configure CSF firewall:
# Install CSF
cd /usr/src
wget https://download.configserver.com/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh
# Edit /etc/csf/csf.conf
TCP_IN = "20,21,22,25,53,80,110,143,443,465,587,993,995,8090"
TCP_OUT = "20,21,25,53,80,110,443,465,587"
# Enable port scan protection
PS_INTERVAL = "60"
# Restart CSF
csf -r
Configure OpenLiteSpeed connection limits:
# /usr/local/lsws/conf/httpConfig.conf
connection {
maxConns 2000
maxSSLConns 500
connTimeout 30
keepAliveTimeout 5
maxKeepAliveReqs 100
}
# Rate limiting per IP
rules {
rateLimiting {
enabled 1
limit 100/minute
blockPeriod 600
}
}
Enable ModSecurity WAF:
# CyberPanel UI → Security → ModSecurity
# Enable ModSecurity
# Select OWASP Core Rule Set
# Or via CLI
cd /usr/local/CyberCP
python3 manage.py installModSecurity
Edit /usr/local/CyberCP/CyberCP/settings.py:
# Security settings
# Disable debug in production
DEBUG = False
# Allowed hosts (add your server IP/domain)
ALLOWED_HOSTS = ['your-server-ip', 'cyberpanel.example.com']
# Password requirements
AUTH_PASSWORD_VALIDATORS = [
{'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator', 'OPTIONS': {'min_length': 12}},
{'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator'},
{'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator'},
]
# Login attempt limits
LOGIN_ATTEMPTS_LIMIT = 5
LOGIN_COOLDOWN_PERIOD = 300 # 5 minutes
Configure PHP security settings (/usr/local/lsws/lsphp*/etc/php/*/litespeed/php.ini):
[Security]
expose_php = Off
allow_url_fopen = Off
allow_url_include = Off
disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source
display_errors = Off
log_errors = On
error_reporting = E_ALL
open_basedir = "/home:/tmp:/var/tmp"
upload_max_filesize = 64M
post_max_size = 64M
max_execution_time = 30
max_input_time = 60
memory_limit = 256M
[Session]
session.cookie_httponly = 1
session.cookie_secure = 1
session.use_only_cookies = 1
session.cookie_samesite = Lax
Restart OpenLiteSpeed:
systemctl restart lscpd
CyberPanel includes WordPress-specific security features:
Enable via CyberPanel UI:
Configure wp-config.php hardening:
# Add to wp-config.php
define('DISALLOW_FILE_EDIT', true);
define('DISALLOW_FILE_MODS', true);
define('WP_AUTO_UPDATE_CORE', 'minor');
define('FORCE_SSL_ADMIN', true);
Set secure file permissions:
# WordPress core files
find /home/example.com/public_html -type f -exec chmod 644 {} \;
find /home/example.com/public_html -type d -exec chmod 755 {} \;
chmod 600 /home/example.com/public_html/wp-config.php
# Ownership
chown -R nobody:nobody /home/example.com/public_html
Secure MariaDB/MySQL:
# Run secure installation
mysql_secure_installation
# Key settings:
# - Set root password
# - Remove anonymous users
# - Disallow root login remotely
# - Remove test database
Configure /etc/my.cnf.d/server.cnf:
[mysqld]
# Network security
bind-address = 127.0.0.1
skip-networking = 1
local-infile = 0
# Password policy
secure_file_priv = /var/lib/mysql-files
# Logging
log_error = /var/log/mysql/error.log
slow_query_log = 1
slow_query_log_file = /var/log/mysql/slow.log
CyberPanel default permissions:
# Home directories
chmod 711 /home/username
chown username:username /home/username
# Public HTML
chmod 755 /home/username/public_html
chown nobody:nobody /home/username/public_html
# Configuration files
chmod 600 /home/username/.my.cnf
chmod 644 /home/username/public_html/.htaccess
# SSH directory
chmod 700 /home/username/.ssh
chmod 600 /home/username/.ssh/authorized_keys
Verify permissions:
# CyberPanel permission fix script
/usr/local/CyberCP/bin/fixPermissions
Update CyberPanel:
# Check current version
/usr/local/CyberCP/bin/cyberPanel --version
# Update to latest version
sh <(curl https://cyberpanel.net/install.sh || wget -O - https://cyberpanel.net/install.sh)
# Or update via CLI
/usr/local/CyberCP/bin/cyberPanel update
Enable automatic updates:
# Add to crontab
0 3 * * * /usr/local/CyberCP/bin/cyberPanel update >> /var/log/cyberpanel-update.log 2>&1
Update OpenLiteSpeed:
# Check for OLS updates
/usr/local/lsws/bin/lsup -f -v
# Install update if available
/usr/local/lsws/bin/lsup -i
CyberPanel log locations:
| Log File | Purpose |
|---|---|
/var/log/cyberpanel/cyberpanel.log |
Main panel logs |
/var/log/cyberpanel/error.log |
Panel errors |
/var/log/cyberpanel/access.log |
Panel access |
/usr/local/lsws/logs/error.log |
OpenLiteSpeed errors |
/usr/local/lsws/logs/access.log |
OpenLiteSpeed access |
/var/log/mysql/error.log |
Database errors |
View recent activity:
# CyberPanel logs
tail -f /var/log/cyberpanel/cyberpanel.log
# Filter for login events
grep -i "login\|auth" /var/log/cyberpanel/cyberpanel.log
# OpenLiteSpeed logs
tail -f /usr/local/lsws/logs/error.log
# Failed login attempts
grep "403\|401" /usr/local/lsws/logs/access.log | tail -50
Set up alerts for:
Configure log rotation:
# /etc/logrotate.d/cyberpanel
/var/log/cyberpanel/*.log {
daily
rotate 30
compress
delaycompress
missingok
notifempty
create 640 root root
}
Rsyslog configuration:
# /etc/rsyslog.d/cyberpanel.conf
:filename, contains, "cyberpanel" /var/log/cyberpanel/central.log
:filename, contains, "cyberpanel" @syslog.example.com:514
:filename, contains, "lsws" @syslog.example.com:514
# Restart rsyslog
systemctl restart rsyslog
Filebeat for ELK stack:
# /etc/filebeat/modules.d/cyberpanel.yml
- module: cyberpanel
access:
enabled: true
var.paths: ["/var/log/cyberpanel/access.log"]
error:
enabled: true
var.paths: ["/var/log/cyberpanel/error.log"]
lsws:
enabled: true
var.paths: ["/usr/local/lsws/logs/*.log"]
Install and configure ClamAV:
# Install ClamAV
sudo apt install clamav clamav-daemon # Debian/Ubuntu
sudo dnf install clamav clamav-update clamav-scanner-systemd # RHEL/Fedora
# Update virus database
sudo freshclam
# Schedule regular scans
0 2 * * * clamscan -r /home --exclude="^/home/.*/public_html/wp-content/cache" --move=/home/quarantine >> /var/log/clamav/cyberpanel-scan.log 2>&1
CyberPanel built-in scanner:
# CyberPanel UI → Security → Malware Scan
# Or via CLI
/usr/local/CyberCP/bin/cyberPanel malwareScan --all
CyberPanel provides a REST API for automation. Secure it properly:
Generate API key:
# CyberPanel UI → API → Manage API Keys
# Create new key with specific permissions
API security best practices:
Example API call:
curl -k -X POST https://your-server:8090/api/createWebsite \
-H "Content-Type: application/json" \
-d '{"apiKey": "YOUR_API_KEY", "domainName": "example.com", ...}'
| Control | Status | Notes |
|---|---|---|
| 2FA enabled for all admins | ☐ | Enforce via settings |
| Default admin changed | ☐ | Create new admin account |
| HTTPS with valid certificate | ☐ | Let’s Encrypt recommended |
| Firewall configured | ☐ | CSF with port restrictions |
| ModSecurity WAF enabled | ☐ | OWASP ruleset |
| PHP hardening applied | ☐ | Disable dangerous functions |
| WordPress security enabled | ☐ | If using WordPress |
| Database secured | ☐ | mysql_secure_installation |
| File permissions verified | ☐ | Run fixPermissions script |
| Malware scanning enabled | ☐ | ClamAV + built-in scanner |
| Centralized logging | ☐ | Forward to SIEM |
| API keys secured | ☐ | If using API |
| Regular updates scheduled | ☐ | CyberPanel + OLS |
If you suspect a security breach:
Isolate the server - Block external access via firewall
csf -d ALL # Block all incoming (CSF)
Preserve evidence - Copy logs before rotation
cp -r /var/log/cyberpanel /root/cyberpanel-logs-$(date +%Y%m%d)
cp -r /usr/local/lsws/logs /root/lsws-logs-$(date +%Y%m%d)
Scan for malware
/usr/local/CyberCP/bin/cyberPanel malwareScan --all --deep
clamscan -r /home --move=/home/quarantine
Review recent changes
grep "CREATE\|DELETE\|UPDATE" /var/log/cyberpanel/cyberpanel.log | tail -100
Change all credentials - Admin passwords, API keys, database passwords, FTP accounts
Check for unauthorized websites
ls -la /home/
# Review for unknown domains
Patch vulnerabilities - Update CyberPanel, OpenLiteSpeed, PHP, and all packages
Restore from clean backup - If compromise is severe, restore known-good state
Notify affected users - If customer data was exposed