DOCSEARCHbyAlgolia
Submit Docs

cPGuard X Documentation

website·Indexed 33 days ago

https://support.opsshield.com

Comprehensive guides for cPGuard X, covering installation, website management, PHP configuration, Nginx and Apache web server settings, database administration via phpMyAdmin, and security features including SSL, SSH, and firewall controls.

Tokens
62K
Snippets
296
Records
570
Agent score
64%

What's inside cPGuard X

  1. Overview of cPGuard SRBL (Spam Real-time Black List)

    cPGuard SRBL is a spam filtering mechanism integrated with the Exim mail server. It checks incoming email sender IP addresses against multiple RBL databases (including Abuseat, Barracuda, SpamEatMonkey, and cPGuard's in-house engine) to block spam before it reaches the server queue, reducing server load and improving performance. It is supported only on cPanel/WHM and DirectAdmin control panels.

  2. Overview of Lynis security auditing in cPGuard X

    cPGuard X integrates Lynis, an open-source security auditing tool for Linux and Unix-based systems, to replace the traditional Rootkit Scanner. Unlike reactive tools, Lynis is proactive, identifying vulnerabilities, misconfigurations, and weak security practices to help harden the server before exploits occur. It scans several categories including:

    • System configuration (e.g., kernel parameters, file permissions)
    • Services and daemons (e.g., SSH configuration, unnecessary services)
    • Authentication (e.g., PAM configuration, password policies)
    • Software and patches (e.g., outdated packages)
    • File integrity (e.g., SUID/SGID binaries, world-writable files)
    • Networking (e.g., firewall gaps, open ports)
    • Logging and auditing (e.g., audit trails)

  3. Overview of cPGuard Database Scanner

    The cPGuard Database Scanner is a specialized module designed to identify malicious code injections within CMS databases (currently highly optimized for WordPress). It detects threats such as malicious redirects, JavaScript injections in posts/pages, and hidden backdoors that allow attackers to maintain persistence even after file-level malware is removed.

  4. Overview of cPGuard App Portal Mass Operations

    The Mass Operations feature allows administrators to perform actions across multiple servers from a single interface. This is used to maintain consistent security and configuration policies, respond quickly to security incidents, and reduce repetitive manual work across production, staging, or testing environments.

  5. Overview of Proactive Process Monitor

    The Proactive Process Monitor periodically scans for and terminates suspected malicious processes running under users on the server. If you receive a 'Suspicious Process Detected and Killed' alert, it typically means the process has already been handled automatically and no further action is required unless the alert recurs. Note that such alerts often indicate a PHP script triggered suspicious behavior, rather than the PHP binary itself being infected.

  6. Overview of cPGuard Single Sign-On (SSO)

    Single Sign-On (SSO) in the cPGuard Admin Plugin allows administrators and clients to access the cPGuard interface directly from a supported hosting control panel without requiring a separate username or password. Authentication is validated at the server level and inherits the session from the control panel. SSO is supported on cPanel/WHM, DirectAdmin, and Webuzo.

  7. Overview of cPGuard Outgoing Spam Monitor (OSM)

    Outgoing Spam Monitor (OSM) is a security feature that detects and prevents spam emails originating from a server. It monitors outgoing email activity in real-time to identify compromised email accounts, malicious scripts, and unusual sending patterns to protect the server from IP blacklisting and reputation damage. It is compatible with the following control panels: cPanel, DirectAdmin, and Webuzo.

  8. Overview of cPGuard Intrusion Defense (LFD)

    Intrusion Defense (LFD) monitors server logs (SSH, FTP, mail, web, and control panel) in real time to detect suspicious activity. When an IP address exceeds a defined number of failed attempts within a specific time window, LFD automatically applies a temporary ban. This protects the server against brute-force attacks, credential stuffing, and bot-driven HTTP abuse.

  9. Overview of Reverse Proxy in CPGuard X

    Reverse Proxy forwards public website traffic (typically on ports 80 for HTTP and 443 for HTTPS) to a private service running on the server. This allows visitors to access an application listening on a private port (e.g., 127.0.0.1:3000) using a standard domain or URL path without needing to specify the port in the browser.

  10. Overview of ModSecurity and cPGuard WAF

    ModSecurity is an open-source web application firewall (WAF) designed to protect web applications (e.g., WordPress, Joomla, OpenCart) from Layer 7 (HTTP) attacks such as SQL injection, cross-site scripting (XSS), and local file inclusion. cPGuard WAF is a proprietary set of ModSecurity rules, powered by Malware.Expert Commercial ModSecurity rules, specifically designed for web hosting servers to block generic, targeted, and automated attacks.

  11. Overview of cPGuard server tagging

    cPGuard's tagging feature allows users to group servers using custom labels. Tags are used to classify, filter, and organize servers into logical groups, which is particularly useful for managing large fleets across different environments, regions, or clients. A single server can be assigned multiple tags.

  12. Overview of the OpsShield App Portal

    The App Portal is a centralized graphical interface located at app.opsshield.com that allows users to view, manage, and monitor all servers from a single login. It decouples server management from individual control panels by communicating with the cPGuard agent service running on each server. It is compatible with cPanel, DirectAdmin, Plesk, and cPGuard X Standalone.