Brute-force & flood protection
MyPanel protects your server from password guessing (brute-force) and request floods (application-layer) with two complementary layers — no heavy WAF required:
- Fail2ban — automatically bans attacking IPs at the system level.
- nginx rate limiting — throttles request floods per website.
Fail2ban — automatic IP banning
Section titled “Fail2ban — automatic IP banning”Open the Brute-force protection menu. The panel manages Fail2ban visually:
- Overview tiles — whether Fail2ban is installed/running, the number of jails, and total currently banned IPs.
- One-click brute-force protection — a single toggle that enables a recommended jail set with safe defaults:
sshd— SSH password guessing.nginx-http-auth— wrong HTTP Basic auth passwords.nginx-limit-req— exceeding the nginx rate limit (ties into the rate-limit layer below).nginx-botsearch— scanning for malicious URLs.
- Adjust the ban time (
bantime, e.g.10m,1h,1d) and max retries (maxretry). - A list of currently banned IPs per jail, each with an Unban button (for when you lock yourself out).
The panel writes its config to a separate file (/etc/fail2ban/jail.d/mypanel.local) — it never touches
your system config — then reloads Fail2ban. If the reload fails, the panel restores the previous config.
Per-website rate limiting
Section titled “Per-website rate limiting”Inside each website, open the Nginx → Rate limiting tab. Enable it to throttle request floods (L7) and
slow down password guessing (e.g. wp-login.php):
- 3 presets — Relaxed / Normal / Strict — or set your own:
- Dynamic requests/sec per IP (rate).
- Burst allowance for short spikes.
- Concurrent connections per IP (conn).
- Static assets (images, CSS, JS, fonts…) are excluded from the count, so normal page loads with
many files aren’t wrongly blocked (
429).
When the limit is exceeded, nginx returns 429 Too Many Requests. Fail2ban’s nginx-limit-req jail
reads those 429 events to fully ban the offending IP — the two layers reinforce each other.