CPGuard ​
CPGuard is a server security suite: malware scanning and cleanup, a web application firewall, brute force protection, and firewall management. It is an alternative to Imunify360 and ImunifyAV, and only one of the three can be active on a server.
Installing ​
The module page is at /admin/modules/cpguard, in the Module Manager. Install it from there with your license key. The installer has its own page at /admin/cpguard-installer.
The CPGuard page ​
URL: /admin/cpguard
Once installed, the admin page reports what the panel can see:
| Field | What it shows |
|---|---|
| Installed | Whether the suite is on this server. |
| Service | Whether it is running. |
| Connected | Whether the panel can reach it. |
| WAF rules | Which rule set the web application firewall is using. |
Open CPGuard Dashboard signs you in to the CPGuard app, which is where the suite itself is managed. The panel page is the connection and the switch, not a second console.
When the panel cannot reach the suite, the status area says so rather than showing a stale all-clear.
Scans ​
Since panel 1.9.0 the CPGuard page holds the full history of manual scans on the server, with two actions to start one:
- Scan an account scans every file in the home directory of the Hosting account you pick. Large accounts take a while; the result appears in the list when the scan finishes.
- Scan whole server scans every directory on CPGuard's watch list. This walks the disk of every account and can take hours on a busy server. Only one whole-server scan runs at a time.
The list shows scans started here, scans clients started from their own CPGuard page, and scans started with CPGuard's own tools on the server. Each row shows the scan, the Account, the Target, who Started by, the Status, when it Started and Finished, the Files scanned, and the number of Detections.
- Detections lists what the scan found. A scan still running shows what it has found so far.
- Stop stops a running scan.
- Delete removes a finished scan and its results from CPGuard and from the list, after a confirmation. The account's client no longer sees it either.
Use CPGuard WAF ​
Use CPGuard WAF switches the web application firewall from the shipped rule set to CPGuard's own, enabling its security engine and restarting the web server as needed. Switching back restores the shipped rules.
Treat this as a change to how every site on the server is filtered. A different rule set blocks different requests, so expect to review false positives afterwards rather than assuming the switch is invisible.
Note: Under LiteSpeed, the CPGuard app does not report firewall events. Blocking itself is unaffected. The page states this where it applies.
Accounts ​
Accounts and domains are kept in step with CPGuard as they are created, changed, and removed, including after a web server switch. Give accounts the client page through the CPGuard feature on their hosting plan. On that page clients see the scans of their own account and can start a scan of their own files; see CPGuard in the client panel.
Related pages ​
- Imunify360 and ImunifyAV - the other security modules. Only one of the three can be active on a server.
- Module Manager - where modules are installed.
- ModSecurity Rules - the shipped rule set CPGuard's WAF replaces.
- Hosting Plans - the feature that exposes the client page.