Chapter 10 • Guide 11 of 31
Website security
The Security tab applies protections in Nginx before traffic reaches the application.
Traffic filtering
Available controls include:
- Block known abusive bots.
- Block WordPress-targeted requests on websites that do not need them.
- Block AI crawlers.
- Reject empty user-agent requests.
- Add browser security headers.
- Block exact IPv4/IPv6 addresses or CIDR networks.
The Traffic page can add a client IP directly to this website's blocked list. Review an address before blocking it, particularly when traffic passes through a trusted reverse proxy.
Password protection
Enable HTTP Basic Authentication to require a username and password before visitors can access the website. Passwords must contain at least 12 characters and are stored as one-way hashes.
Trusted IPv4/IPv6 addresses or CIDR networks can be allowlisted so they bypass the password prompt.
Malware scan
Open Malware scan to scan the complete managed website root using the server's current ClamAV signatures. Scans are read-only: Core Panel does not automatically delete or quarantine detected files. Review every finding, make a backup if appropriate, and investigate or remove malicious content deliberately.