Docs / Security / Security Advisor

Security Advisor

Panelica 1.0.375 Verified 2026-07-24 Security

Security Advisor answers "is my server secure?" without you having to know what to check. It runs the server through dozens of security checks, scores the result out of 100, groups the problems, and for many of them offers a one-click fix that will not lock you out of your own server.

Panel locationSecurity → Security Advisorhttps://YOUR-SERVER-IP:8443/security/advisor

Security Advisor

Security Score

Good

SSH root login failed · Auto-Fix

Fail2ban warning · Auto-Fix

Firewall passed

The score and the checks

A ring shows your score, colored green above 80, amber above 60, red below, with a count of passed, warning and failed checks. Each finding names the problem, its severity, and what to do. The checks span eight areas: SSH, the panel itself, firewall, running services, authentication, database, SSL and updates.

Area	What it checks
SSH	Non-standard port, root login policy, password authentication, empty passwords
Panel	High Security Mode on, login rate limiting, session timeout, valid panel HTTPS certificate
Firewall	Whether the firewall is actually enabled
Services	Fail2ban, ModSecurity WAF, ClamAV and a recent backup all present; process isolation (hidepid)
Authentication	2FA on the root account, root password strength, 2FA enforcement for admins
Database	Whether MySQL/PostgreSQL are exposed beyond localhost
SSL	Domain certificates expired or expiring soon
Updates	Pending panel and OS updates (read from cache, never triggering a package run)

Behind the scenes: the score is weighted by severity (a critical finding costs far more than a low one), and every check runs by actually inspecting the server: reading the real SSH config, checking whether fail2ban is running, parsing the panel certificate, querying the database's bind address. Results are cached briefly because on a busy server these checks shell out to many commands. The AppArmor status is shown as a separate card and deliberately kept out of the score.

One-click fixes that will not lock you out

Many findings carry an Auto-Fix button (harden the SSH root-login policy, enable the firewall, start ClamAV, bind the database to localhost). This is the feature's real value: the fixes are the dangerous ones to do by hand, and Panelica does them with a safety net.

Behind the scenes, the pre-flight lockout check: before applying a fix, the panel runs a pre-flight that asks "will this lock the operator out?". Disabling SSH password authentication when no SSH key is installed, for example, is blocked with a clear explanation rather than applied. Enabling the firewall automatically allows SSH, the panel port and 80/443 first. If the pre-flight fails you get a red safety-check dialog listing the blockers; only a deliberate second confirmation forces it through. Every applied fix is recorded with its before and after values, and many can be rolled back from the history tab.

The database check is smart about false alarms. A database bound to all interfaces is only flagged if its users can actually connect from outside; if every account is localhost-only, it passes. This defense-in-depth logic means the advisor points you at real exposure rather than crying wolf about a bind address that is not actually reachable.

Access

Applying fixes is an operator action (the checks describe themselves as being for ROOT), scoped through the panel's permission system. See roles and permissions. Think of Security Advisor as the front door to the rest of this section: it will point you at the Firewall, IP Blocking, ModSecurity and SSH pages where the deeper controls live.

Panelica Documentation · Written and verified against the live panel. · Last verified 2026-07-24 on Panelica 1.0.375