Skip to content

Brute-force & flood protection

MyPanel protects your server from password guessing (brute-force) and request floods (application-layer) with two complementary layers — no heavy WAF required:

  1. Fail2ban — automatically bans attacking IPs at the system level.
  2. nginx rate limiting — throttles request floods per website.

Open the Brute-force protection menu. The panel manages Fail2ban visually:

  • Overview tiles — whether Fail2ban is installed/running, the number of jails, and total currently banned IPs.
  • One-click brute-force protection — a single toggle that enables a recommended jail set with safe defaults:
    • sshd — SSH password guessing.
    • nginx-http-auth — wrong HTTP Basic auth passwords.
    • nginx-limit-req — exceeding the nginx rate limit (ties into the rate-limit layer below).
    • nginx-botsearch — scanning for malicious URLs.
  • Adjust the ban time (bantime, e.g. 10m, 1h, 1d) and max retries (maxretry).
  • A list of currently banned IPs per jail, each with an Unban button (for when you lock yourself out).

The panel writes its config to a separate file (/etc/fail2ban/jail.d/mypanel.local) — it never touches your system config — then reloads Fail2ban. If the reload fails, the panel restores the previous config.

Inside each website, open the Nginx → Rate limiting tab. Enable it to throttle request floods (L7) and slow down password guessing (e.g. wp-login.php):

  • 3 presets — Relaxed / Normal / Strict — or set your own:
    • Dynamic requests/sec per IP (rate).
    • Burst allowance for short spikes.
    • Concurrent connections per IP (conn).
  • Static assets (images, CSS, JS, fonts…) are excluded from the count, so normal page loads with many files aren’t wrongly blocked (429).

When the limit is exceeded, nginx returns 429 Too Many Requests. Fail2ban’s nginx-limit-req jail reads those 429 events to fully ban the offending IP — the two layers reinforce each other.