In the field of Safety of your CURIAWEB cPanel you will find tools to protect your hosting account, your websites, and encrypted communication. Here you can, among other things, manage SSL certificates, enable two-factor authentication, block IP addresses, and access security-related features such as ModSecurity and Imunify360.
At CURIAWEB you will find the functions in this area SSH access, IP blocking, SSL/TLS Certificates, Manage API tokens, Hotlink protection, Protection against password sharing, ModSecurity, Two-factor authentication and Imunify360.
In this article, we explain what these security features are intended for and which settings require special caution.
Briefly explained: Security in web hosting does not consist of a single feature. For example, SSL protects data transmission, two-factor authentication secures your cPanel access, and Imunify360 helps protect the hosting environment and your websites from various threats.
Where can you find the security features? #
Log in to your CURIAWEB cPanel and open the section on the home page Safety.
There you will find the following features:
- SSH access
- IP blocking
- SSL/TLS Certificates
- Manage API tokens
- Hotlink protection
- Protection against password sharing
- ModSecurity
- Two-factor authentication
- Imunify360
An overview of all areas of your cPanel can be found under cPanel at CURIAWEB explained: All areas and functions at a glance.
SSH access #
SSH stands for Secure Shell and provides encrypted access to the command line of a server or hosting account.
Instead of managing files and settings exclusively through graphical interfaces, technically experienced users can perform certain tasks via terminal commands.
SSH is used, for example, by developers and administrators for command-line tools, file management, development workflows, or other technical tasks.
You don't necessarily need SSH for the normal administration of a website.
Important: SSH provides direct access to the technical features of your hosting account. Do not run commands from someone else's guide if you do not understand what those commands will change or delete.
SSH keys #
SSH can be used with cryptographic key pairs. Here, a key pair consists of a private and a public Key.
The public key can be stored on the target system. The private key remains with the user and must not be disclosed to third parties.
Safety: Treat a private SSH key like a highly sensitive access credential. Do not publish it, do not transmit it unencrypted, and do not store it in publicly accessible locations.
IP blocking #
With the IP blocking can you block access from certain IP addresses or correspondingly defined address ranges to your website.
This can be useful, for example, if unwanted or malicious requests are repeatedly sent from a specific address.
However, IP blocking should be used selectively. IP addresses can be assigned dynamically or shared among multiple users.
Blocking a single IP address is therefore not a general solution to spam, bots, or attacks.
Attention: Before blocking large IP ranges, check carefully which addresses are affected. A rule that is too broad may also block legitimate visitors.
SSL/TLS Certificates #
Under SSL/TLS Certificates You manage certificates and the associated cryptographic information for encrypted connections.
SSL, or—from a technical standpoint today—primarily TLS enables the encrypted transmission of data between a client and the server.
On a website, you can usually tell that a connection has been set up this way by an address that starts with https:// begins.
What does HTTPS protect? #
HTTPS protects data transmitted between the browser and the web server from being easily intercepted or tampered with during transmission and allows the browser to verify the identity for which the certificate was issued or is valid.
This is particularly important for registrations, forms, customer data, and other sensitive transmissions.
However, HTTPS does not mean that the website itself is automatically free of security vulnerabilities or malware.
Important: A valid SSL/TLS certificate does not confirm that a website is trustworthy in terms of its content or completely secure from a technical standpoint. It primarily protects the encrypted connection and provides the authentication intended for it.
Certificate, private key and CSR #
When working manually with SSL/TLS, you may encounter several terms.
The Certificate contains, among other things, information about the secured identity or domain and is signed by a certificate authority.
The corresponding one private key It is secret and must not be published.
A CSR – Certificate Signing Request – is a certificate request used in certain procedures for issuing a certificate.
Safety: A private SSL/TLS key must not be publicly accessible. Anyone who has the matching private key possesses a security-critical component of the certificate configuration.
SSL certificate and HTTPS are closely connected, but not identical #
A certificate is a technical component of the HTTPS configuration. However, for a website to actually function correctly via HTTPS, the web server and the website must also be configured accordingly.
For example, a website can have a valid certificate and still load internal resources via unencrypted HTTP. In that case, so-called mixed content issues can occur.
HTTP to HTTPS redirects and the configuration of the respective web application can also play a role.
Manage API tokens #
With API Tokens Applications or automated processes can access authorized cPanel functions without having to use the normal cPanel password.
This is relevant, for example, in automations or external management systems.
An API token is an access key and must be protected accordingly.
Important: API tokens do not belong in publicly accessible files, screenshots, support forums, or source code repositories. Treat them like credentials.
Why are separate tokens useful? #
A dedicated token can be created for a specific purpose and later revoked without having to change your actual cPanel password.
When an integration is no longer in use, a token created for it should not remain active unnecessarily.
Hotlink protection #
With the Hotlink protection Can you prevent or restrict other websites from embedding certain files directly from your domain?.
A typical example is images.
If an external website does not copy an image to its own server, but instead embeds it directly via a URL from your domain, the file continues to be served from your hosting with every corresponding request.
This generates data traffic on your hosting, even though the content is displayed on a third-party website.
Configure hotlink protection wisely #
Not every external use of a file is automatically unwanted. Certain applications, CDNs, or other legitimate services may also access resources on your domain.
An overly restrictive configuration can therefore lead to images or other files no longer being displayed in places where you actually need them.
Practical Tip: Do not enable hotlink protection simply on principle. First, check whether unwanted hotlinking is actually occurring and which external services your website uses.
Protection against password sharing #
The function Protection against password sharing is related to protected web directories and is intended to prevent access credentials for such areas from being improperly reused or shared.
It is therefore a special addition for certain access-protected areas and not a general password manager for cPanel, WordPress, or email accounts.
For most normal websites, this function does not need to be changed.
ModSecurity #
ModSecurity is a Web Application Firewall, or WAF for short WAF, which can inspect HTTP requests based on defined security rules.
Such rules can detect suspicious or known attack patterns and block corresponding requests before they are processed by a web application.
This can help, for example, with protection against certain web-based attack methods.
Why can ModSecurity block a legitimate request? #
A Web Application Firewall must decide based on technical characteristics whether a request appears suspicious. In certain cases, legitimate requests can also trigger a security rule.
This is considered as False Positive referred to as.
One possible symptom can be, for example, that a specific action within a website is blocked, even though other areas function normally.
Attention: Do not disable ModSecurity permanently just because a single action is blocked. First, you should check which security rule was triggered and why.
ModSecurity is not a replacement for a secure website #
A Web Application Firewall provides an additional layer of protection. However, it does not replace updates, secure passwords, or the securing of the actual web application.
An outdated WordPress installation or a plugin with a security vulnerability does not become more secure software just because a firewall operates in front of it.
Several protective mechanisms therefore complement each other.
Two-factor authentication #
With the Two-factor authentication – short 2FA – you can additionally secure access to your cPanel.
For a normal login, a username or account and the corresponding password are sufficient. If two-factor authentication is enabled, a second factor is also required.
In cPanel, a time-based one-time code generated by a compatible authenticator app is typically used for this.
Why is 2FA useful? #
If your password is stolen or otherwise exposed, with two-factor authentication enabled, it alone is no longer enough for a normal login. An attacker would additionally need the second factor.
This significantly increases the security of administrative access with 2FA.
Recommendation: If two-factor authentication is available for your cPanel access, activating it is a sensible additional security measure.
What happens if you lose the second factor? #
If the device with your authenticator app is lost or no longer available, signing in can be made correspondingly more difficult.
Therefore, when setting up two-factor authentication, you should also consider how you will regain access in an emergency or what recovery options are provided for the respective account.
Do not remove a working 2FA configuration lightly just for convenience.
Imunify360 #
Imunify360 is an additional security platform for web hosting environments and is integrated into the CURIAWEB hosting infrastructure.
The solution complements the classic cPanel functions with additional security mechanisms. Depending on the server-side configuration, this can include malware detection and further protection and analysis functions, among other things.
Although Imunify360 is displayed within cPanel, it is a security module not developed by cPanel itself. It is a standalone security solution that integrates into the hosting interface.
Briefly explained: cPanel provides the management interface. Imunify360 is an additional security solution within the CURIAWEB hosting environment. The fact that you access Imunify360 via cPanel does not make it a cPanel-native feature.
Malware Detection with Imunify360 #
An important task of Imunify360 is the detection of suspicious or malicious files within the hosting environment.
If a file is identified as suspicious, it first means that it should be examined for security relevance or treated in accordance with the server-side security configuration.
However, in the case of a compromised website, it is not always sufficient to look at just a single file that was found.
For example, an attacker may have modified several files, created new user accounts, stolen credentials, or exploited a vulnerability in a web application.
Important: If malware is found on a website, the cause of the compromise must also be addressed. Otherwise, a cleaned website can be attacked again via the same vulnerability.
Imunify360 does not replace updates #
Even a comprehensive security platform cannot turn an outdated web application into a permanently secure application.
Therefore, WordPress, plugins, themes, and other installed applications should continue to be kept up to date.
Software that is no longer in use should be removed, especially if it remains publicly accessible or executable.
Multiple security layers work together #
The various security features of your hosting fulfill different tasks and should not be considered interchangeable alternatives.
SSL/TLS secures the data transmission. 2FA makes the abuse of administrative access more difficult. ModSecurity inspects web requests based on security rules. Imunify360 adds further security mechanisms to the hosting environment.
Added to this are secure passwords, up-to-date web applications, correct file permissions, and other server-side protection measures.
The principle of multiple independent layers of protection is frequently referred to in IT security as Defense in Depth referred to as.
What should you do if a security feature blocks something? #
When a legitimate action suddenly stops working, you should not immediately disable all security mechanisms.
First, try to narrow down the problem as precisely as possible. Note down the affected URL, the action performed, the exact time, and the error message displayed.
In case of website issues, the cPanel error logs can also provide important clues.
How we will show you how to evaluate these is below at Read cPanel Error Log and find website errors.
Practical Tip: Disabling a security feature may seemingly fix an error without explaining the actual cause. For a clean solution, it is crucial to find out which mechanism was triggered and why.
403 Forbidden and security features #
An HTTP error 403 Forbidden basically means that access to the requested resource was denied.
Various causes are possible for this. In addition to security rules, file permissions, configuration rules, or access restrictions, for example, can play a role.
Therefore, a 403 error does not automatically prove that ModSecurity or Imunify360 blocked the request.
We will cover systematic troubleshooting later under Fix 403 Forbidden.
What shouldn't you change on suspicion? #
Special caution is advised regarding security functions whose effects you do not fully understand.
Disabling ModSecurity completely, blocking extensive IP ranges, deleting certificate components, or simply ignoring security alerts can cause new problems.
Changes should therefore always have a concrete technical reason.
Basic rule: In the event of a security issue, diagnose first, then make targeted changes. Do not disable multiple security mechanisms at the same time just to check if a website works again afterward.
Security warning or technical error? #
Not every technical problem is a security incident. At the same time, an unusual change to a website should not be hastily dismissed as an ordinary software bug.
A PHP error after an update can, for example, be a normal compatibility problem. Unknown files, unexpected redirects, tampered content, or newly created unknown administrators, on the other hand, can indicate a compromise.
Therefore, the overall context is decisive in the assessment.
Summary #
The area Safety Your CURIAWEB cPanel contains various tools that protect different levels of your hosting.
SSH enables encrypted technical access. Via the IP blocking certain accesses can be blocked. SSL/TLS protects data transmission while API Tokens Enable controlled access for applications and automations.
ModSecurity works as a web application firewall, and the Two-factor authentication offers additional protection for your cPanel access. With Imunify360 is also an independent security platform integrated into the CURIAWEB hosting environment.
Not a single one of these features can cover all security risks. The key is the interplay of multiple layers of protection as well as a well-maintained and up-to-date website.
When a security feature blocks an action or a website displays an error, you should systematically investigate the cause first before disabling protective mechanisms.
