Dashboard
Server overview & real-time metrics
CPU Usage
0%
Load:
RAM
0
Disk
0%
Uptime
Network ↓ ↑
CPU & RAM (last ~2.5 min)
Network I/O
🔒
🛡️
⚠️
Multiple webservers running simultaneously
are all active. This causes port 80/443 conflicts and unpredictable routing.
Stop all but one via Services or App Store.
Services
No services detected
Quick Actions
Websites
Manage Nginx virtual hosts
WP Toolkit
WordPress management — installations detected
⚠ wp-cli not installed
🔍
🔷
Scanning for WordPress installations…
🔷
No WordPress installations found
Install WordPress or place an existing site in your webroot and click Scan
Node.js Projects
Deploy and manage Node.js apps with PM2 or systemd — proxy via nginx, Apache, OLS or Caddy
💚
No Node.js projects yet
Deploy your first Node.js or PM2 project
ℹ App Store integration:
Node.js installed from App Store works directly in Node.js Projects — no extra steps needed.
Use the version manager below only if you need multiple Node.js versions side-by-side via nvm.
Installed Versions
Loading...
No versions installed via nvm
Active
System
Install New Version
✓ Installed
Processes
Total CPU
Total Memory
Add Node.js Project
Directory where package.json is located
The JS file to start (e.g. app.js, server.js, index.js)
Port the app listens on — used for webserver reverse proxy
instances > 1 enables cluster mode
PM2 auto-restarts if exceeded
Restart automatically on crash
Reverse proxy config will be created automatically for your active webserver
• PM2 Project: Startup File is the JS file PM2 runs (usually app.js or server.js)
• Cluster: instances > 1 enables load balancing across CPU cores
• Memory Limit: PM2 auto-restarts when exceeded
• Cluster: instances > 1 enables load balancing across CPU cores
• Memory Limit: PM2 auto-restarts when exceeded
• Default Project: Runs as a systemd service — lightweight, no PM2 needed
• Run Command: Select from package.json scripts or enter a custom command
• Run Command: Select from package.json scripts or enter a custom command
Go Projects
Deploy compiled Go binaries with systemd + webserver reverse proxy
🔵
No Go projects yet
Go Project only supports compiled binary files — not source code.
Compile your Go app → upload the binary → click Add Project
GOPROXY Configuration
Go module proxy — affects download speed and availability of packages
Installed Go Versions
Loading...
No Go versions installed via SDK manager
Active
Install Go Version
Downloaded from dl.google.com — supports amd64 and arm64
Loading...
✓ Active
Installed
Add Go Project
ℹ Go Project only supports compiled binary files. Compile your Go app first, then select the binary here.
Full path to the compiled Go binary. File permissions will be fixed automatically.
Leave blank to use executable path directly
Edit Project —
Databases
⚠ No database engine is installed or running. Install MySQL, MariaDB, PostgreSQL or MongoDB from the App Store.
File Manager
/
App Store
Install and manage server software
Versions
| Version | Status | OPT |
|---|---|---|
| Detail Uninstall Install |
ℹ Each version installs independently to
/www/server/ffmpeg/ffmpeg-{version}/ and is accessible via its own command alias (e.g. ffmpeg8 for 8.1). Installing or removing one version does not affect the others.
Use Uninstall All / Reset to remove everything at once — this also clears any leftover state from an interrupted install.
Service Status
⚠ Config Test Error
Service failed to start. Click Run Test to see the config error, or open the Error Log tab for details. Common causes: port 80 already in use, syntax error in nginx.conf, or a broken site config in /etc/nginx/conf.d/.
Service Info
Configuration File
⚠ Unsaved changes — click Save to apply
Tips: This is the main configuration file. Incorrect modification may cause the service to fail to start.
Performance Optimization
⚠ Optimize according to server hardware. Reserve some resources for other programs.
Error Log
PHP Version
⚠ PHP is not supported by phpMyAdmin 5.2 (requires PHP 7.2–8.4). Install PHP 8.3 or 8.4 from the App Store for best compatibility.
✓ PHP is fully compatible with phpMyAdmin 5.2
phpMyAdmin 5.2 supports PHP 7.2–8.4. Each website can use a different PHP version independently.
Security Configuration
• Enabling public access to phpMyAdmin may have security risks.
• Login with your MySQL root username and password.
• Consider setting up firewall rules to restrict access by IP.
• Login with your MySQL root username and password.
• Consider setting up firewall rules to restrict access by IP.
Docker System Info
ModSecurity has no service of its own to start or stop — it's a module loaded directly into . Its previous "Service" tab checked a systemd unit that never existed, which is why it always showed inactive even while actively blocking requests. Blocking, Detection Only, and Disabled are controlled from the WAF page, not here.
Real Status
Connector/module loaded in
Engine mode (from modsecurity.conf)
Storage Location
Current data directory
⚠ Risk Warning: MySQL will stop running during the migration process.
⚠ Please backup your data before proceeding.
⚠ Please backup your data before proceeding.
Port Configuration
⚠ Changing the port requires a service restart.
⚠ Update your firewall rules and application configs after changing.
⚠ Update your firewall rules and application configs after changing.
Current Status
| Launch Time | Total Connections | ||
| Bytes Sent | Bytes Received | ||
| Queries | Threads Connected |
Current Status
| Field | Value | Description |
|---|---|---|
| uptime_in_days | Days running | |
| tcp_port | Listening port | |
| connected_clients | Active connections | |
| used_memory | Memory in use | |
| mem_fragmentation_ratio | Fragmentation ratio | |
| keyspace_hits | Successful lookups | |
| keyspace_misses | Failed lookups |
Load Status
| Fields | Current value | Note |
|---|---|---|
| bind | Listening IP | |
| port | Listening Port | |
| maxconn | Maximum Connection Limit | |
| cachesize | Maximum Cache Size (MB) | |
| curr_connections | Current Open Connections | |
| cmd_get | GET Request Count | |
| get_hits | GET Hits Count | |
| get_misses | GET Misses Count | |
| bytes_read | Bytes Read | |
| bytes_written | Bytes Written | |
| bytes | Current Memory Usage | |
| curr_items | Current Cached Items | |
| evictions | Evicted Items Due to Memory Limit | |
| hit | GET Hit Rate |
Optimization
Listening IP, please do not modify it freely
Listening port, generally no need to modify
MB, cache size, it is recommended not to exceed 512M
Maximum number of connections, recommended not to exceed 40960
Slow Query Log
Switch Version
⚠ Switching version will stop and restart the service. A live progress terminal will show the output.
⚠ Ensure your applications are compatible with the new version before switching.
⚠ Ensure your applications are compatible with the new version before switching.
Set Persistence
Persistent File Storage Path
AOF Persistence
RDB Persistence (snapshots)
Redis Optimization
⚠ Warning: Do NOT enable Redis external network access — it is a serious security risk.
PHP Extensions
| Name | Type | Description | Status | Action |
|---|---|---|---|---|
| ✓ — |
• Only install extensions your application actually needs
• Install only ONE of: opcache/xcache/apcu at a time
• Install only ONE of: opcache/xcache/apcu at a time
PHP Configuration (Quick Edit)
php.ini
Tips: Ctrl+S to save · Do not edit if you don't understand the config rules
FPM Profile
Tips: Ctrl+S to save · If you do not understand the php-fpm configuration file, please do not modify it
Limit of Upload
upload_max_filesize
post_max_size
max_file_uploads
Limit of Timeout
max_execution_time
max_input_time
memory_limit
Disabled Functions
disable_functions
• Separate function names with commas. Restart PHP-FPM after saving.
Load Average
pm
pm.max_children
pm.start_servers
pm.min_spare_servers
pm.max_spare_servers
Session Configuration
session.gc_maxlifetime
date.timezone
Slow Log
request_slowlog_timeout
Slow log content:
PHP Information
| Version | Install Path | ||
| php.ini | |||
Loaded Extensions
Mail Server Configuration
PHP Version
Select which PHP-FPM version serves Roundcube via Nginx.
ℹ️ Current:
Roundcube Error Logs
DNS Zones
DNS Records
named.conf
• Do not modify if you don't understand BIND configuration rules
Private DNS
Configure BIND9 as an internal/private DNS resolver for your network
🔒 Internal Resolver
Allow only internal networks to use this DNS server for recursive queries
🌐 Forwarders
Forward unresolved queries to upstream DNS servers
ℹ How Private DNS works
• BIND9 acts as a caching/recursive resolver for your internal network• Devices on your network point to this server's IP as their DNS server
• Internal hostnames resolve locally, external queries are forwarded
• Useful for private network name resolution and split-horizon DNS
Domain List
If API-Limit is off, use Global API Key. If on, use limited access token.
How to get the limited access API →
How to get the limited access API →
DDNS Server
Current status:
Current IP:
Check interval:
• The DDNS records you add will be updated automatically according to your server IP changes when the DDNS service is turned on
• The DDNS service checks whether the server IP has changed every 300 seconds by default
• The DDNS service checks whether the server IP has changed every 300 seconds by default
DDNS Log
Caddyfile
Tips: Ctrl+S to save · Caddy reloads with zero downtime
Global Options
These are set in the
{global} block of your Caddyfile
email
ACME/Let's Encrypt email
http_port
Default: 80
https_port
Default: 443
admin
Admin API address
ℹ How global options work
These settings go inside a { block at the top of your Caddyfile, before any site blocks.
The email field is required for automatic HTTPS (Let's Encrypt certificates).
Auto HTTPS
Caddy automatically provisions and renews TLS certificates via Let's Encrypt / ZeroSSL
Set your email in Global Options to enable automatic certificate provisioning
Active Certificates
🔒 SSL Portability
Export Caddy-managed certificates to
/etc/ssl/vortexpanel/ so they remain usable if you switch to Nginx or Apache.ℹ How Auto HTTPS works
• Caddy automatically gets certificates for any domain in your Caddyfile• HTTP (port 80) is automatically redirected to HTTPS (port 443)
• Certificates are renewed automatically before expiry
• Uses Let's Encrypt by default, ZeroSSL as fallback
• Domain must point to this server's IP for certificate issuance
Website Protection
Please start the Fail2ban service first
If the site logs more than matching requests within s, the IP is banned for s.
Server Protection
Please start the Fail2ban service first
Monitors the service log. More than failed attempts within s bans the IP for s.
Black IP List
One IP or CIDR range per line
White IP List
Whitelisted IPs will never be banned. One per line.
Services
Manage system services
Firewall
UFW rules management
Terminal
Live shell — connected via WebSocket PTY
Backups
Create and restore server backups
Local Backups
Cloud Storage
📦 Full Backup
Backs up all websites, nginx/caddy configs, and the backups folder itself in one archive.
💾 Website Backup
🗄 Database Backup
☁ Cloud Storage Provider
Credentials are stored locally on your server, never transmitted elsewhere except to your chosen provider.
Mail Server
Postfix + Dovecot management
Postfix:
Dovecot:
Mailboxes
DKIM / SPF
Queue
Forwarding
Logs
Mail Domains
DKIM / SPF Records
No DKIM key generated yet for this domain.
Add this as a TXT record on your domain's root (@), including your server's mail-sending IP.
Mail Queue
Mail Forwarding Rules
Select a domain to manage forwarding rules
| From Address | Forwards To | Actions |
|---|---|---|
No forwarding rules for
Mail Logs
FTP / SFTP
Pure-FTPd account management
📂
Pure-FTPd Not Installed
Cron Jobs
Schedule automated server tasks
Total
Active
Disabled
Failed
Monitoring
Real-time server performance
CPU Usage
RAM
Disk
Uptime
Log Viewer
Real-time server and application logs
Bandwidth
Network traffic monitoring
Interface
↓ Download
↑ Upload
Total
Daily Usage
| Date | ↓ RX | ↑ TX | Total |
|---|---|---|---|
Per-Domain Traffic
| Domain | Requests | Data |
|---|---|---|
No access log data
Security
Server hardening & intrusion prevention
Security Score
SSH
Fail2ban
ModSecurity
Caddy WAF
Load Balancer
Ports
⚠ Step 1 — Create a sudo user first
✓ Users exist
Before disabling root login, create a regular user with sudo access. Otherwise you'll be permanently locked out.
Existing sudo users:
Username
Password (min 8 chars)
SSH Public Key (optional — paste contents of id_rsa.pub / id_ed25519.pub)
🔑 SSH Key Status
No SSH public key found in
/root/.ssh/authorized_keys.
Add your public key before disabling password authentication, or you'll be locked out.
SSH public key detected. It is safe to disable password authentication.
Paste your public key to add it now
⚙ SSH Hardening
Disable Root Login
Prevents direct SSH login as root. Users must login as a regular user and use sudo.
⚠ Create a sudo user first (Step 1 above)
Disable Password Authentication
Only allow SSH key-based login. Eliminates brute-force attacks completely.
⚠ Add your SSH key first — disabling without a key will lock you out permanently
Enable Public Key Authentication
Allow SSH login using key pairs (recommended, keep enabled).
Max Auth Tries
Max failed attempts before connection is dropped (default: 6, recommended: 3)
SSH Port
Currently active:
● Non-default port
● Default port (risk)
⚠ Firewall rule will be updated automatically. Save from a terminal session to avoid lockout.
⚠ Warning: Keep an active terminal/console session open while saving SSH changes. If you get locked out, use your VPS provider's console/VNC to fix it.
Fail2ban not running — install via Modules
Fail2ban is running — no jails configured yet
Add Website or Server Protection jails from App Store → Fail2ban → Settings
Banned:
🔥 ModSecurity WAF
● Blocking
◑ Detection Only
○ Disabled
Not Installed
ModSecurity WAF is not installed. Install it from the App Store — supports Nginx or Apache, on all distros (Debian, Ubuntu, AlmaLinux, Rocky, Fedora, RHEL, CentOS, Oracle, CloudLinux).
Engine Mode
Blocking mode: requests matching WAF rules are blocked with HTTP 403.
Detection mode: threats are logged but not blocked. Use for testing before going live.
WAF is disabled globally. No rules are evaluated.
OWASP CRS Paranoia Level
(1=default, 4=strictest)
Level 1: Basic protection, very low false positives. Recommended for production.
Level 2: Stricter rules for better protection. Some false positives possible.
Level 3: Aggressive. Test thoroughly before enabling on production.
Level 4: Maximum protection. High false positive risk — advanced users only.
CRS Status
No CRS rules loaded — the ruleset download likely failed during install (network hiccup or GitHub rate limit). The engine itself still works.
Version
Active rules
Per-site WAF override
Disable ModSecurity for specific sites (e.g. admin panels, API servers) without affecting the global setting.
No sites found. Add sites on the Websites page.
WAF Off
Custom Rules
Write custom
SecRule directives here. These are saved to Audit Log
No audit log yet
No triggered rules yet — or audit log is empty.
| Time | IP | Method | URI | Rule ID | Severity | Message |
|---|---|---|---|---|---|---|
🛡️ Caddy WAF
● Installed
Not Installed
Caddy WAF (fabriziosalmi/caddy-waf) is not installed. Install it from the App Store — Caddy only, requires rebuilding Caddy with the module compiled in.
HTTP
TCP / Stream
Active Health Checks
⚖ HTTP Load Balancer
Your backend application must already set this cookie — nginx uses its value to consistently route the same client to the same backend.
⚠ nginx's stream module isn't installed. Required for TCP load balancing.
🔌 TCP / Stream Load Balancer
Load-balances raw TCP connections — for non-HTTP services like databases, game servers, custom protocols, or MQTT brokers. Works at the connection level, not the request level.
💓 Active Health Checks
Periodically probes each backend in your HTTP Load Balancer. A backend that fails enough consecutive checks is automatically removed from rotation — and restored once it recovers. Open-source nginx has no built-in active health checking, so this runs as its own lightweight background service.
Enable health checking
Backend Status
Recent Activity
Open Ports
WAF Analytics
ModSecurity + OWASP CRS attack visibility — free, no upsell
ModSecurity isn't installed yet
Blocked Requests
Top Attack Type
Unique Attacker IPs
Attack Categories
Blocked Requests Over Time
Attack Categories
No attacks blocked in this period
Top Attacker IPs
No attacks blocked in this period
Top Targeted URLs
No attacks blocked in this period
| Time | IP | Domain | URL | Type |
|---|---|---|---|---|
No matching entries
These rules apply server-wide, not per-site — matches every domain on this server. Per-site scoping isn't built yet. Whitelisted IPs skip ModSecurity/CRS entirely for that request (faster, not just "not blocked"). Changes are validated against
nginx -t before going live — a bad entry is rejected and nothing on the server changes.IP Whitelist
One IP or CIDR per line — e.g.
1.2.3.4 or 10.0.0.0/24IP Blacklist
One IP or CIDR per line — blocked with 403 at every site
User-Agent Blacklist
One regex pattern per line, matched against the User-Agent header
URL Blacklist
One regex pattern per line, matched against the request URI
Docker
Container management with Docker Hardened & Official images
Checking Docker status...
🐋
Docker Not Installed
Install Docker CE via the Modules page to enable container management and one-click application deployment.
⚠️
Docker Daemon Not Running
Run:
systemctl start docker
Docker
Running
containers · images
🐳 Image Catalog
📦 Containers ()
🖼 Local Images ()
💾 Volumes
🔒
Docker Hardened Images (DHI) Zero-CVE
Images marked 🔒 Hardened are built with zero-known CVEs, signed provenance and full SBOM — production-grade security.
No containers. Deploy from the Catalog tab.
No images pulled yet. Deploy from the Catalog.
Volumes ()
No volumes
Networks ()
No networks
Caddy Web Server
Automatic HTTPS · HTTP/3 · Zero-config TLS via Let's Encrypt
🟩
Caddy Not Installed
Caddy is a modern web server with automatic HTTPS — it provisions and renews Let's Encrypt certificates automatically with zero configuration.
✓ Auto HTTPS (Let's Encrypt)
✓ HTTP/3 support
✓ Built-in reverse proxy
✓ PHP-FPM support
✓ No certbot needed
Caddy
🔒
Auto HTTPS
Let's Encrypt + ZeroSSL
⚡
HTTP/3 Ready
QUIC protocol support
🔀
Reverse Proxy
With load balancing
🐘
PHP-FPM
FastCGI built-in
Caddy Logs
CDN Manager
Connect and manage your Content Delivery Network
⚡ Active
⚡
CDN Manager — VortexPanel Hot Module
Connect any CDN provider in seconds. Full API integration for Cloudflare and BunnyCDN — purge cache, manage DNS, toggle settings, view analytics. Nginx cache-header optimization for all other providers.
✓ Connected
⚡ Active
Free plan available
Paid service
✓ Full API Integration — Cache purge, settings management, analytics, DNS management all available.
ℹ Nginx Header Optimization — VortexPanel configures your Nginx server with optimal cache headers for this CDN provider, maximizing cache hit rates.
Total Requests
Bandwidth
Cached Requests
Threats Blocked
🔧 Zone Settings
🗑 Cache Purge
Purge cached files from Cloudflare edge servers. Leave URL empty to purge everything.
⚠ Purge Everything clears all cached content — use sparingly on high-traffic sites.
🌐 DNS Records
Click Load to fetch DNS records
🔶 Proxied
Bandwidth Used
Requests Served
Cache Hit Rate
Pull Requests
🗑 Purge Cache
🔗 Connection Test
✓ CDN detected:
⚙ Apply Nginx Cache Headers
VortexPanel will add optimized
Cache-Control headers to your Nginx config for , maximizing CDN cache hit rate.
✓ Headers applied to Nginx and reloaded
Settings
Panel configuration & security
🛡️
Security Updates
Applying — this can take a few minutes
🌐
Network & Access
Panel port and domain settings
Panel name
Panel port
Currently: — suggested: 8888–65535
⚠ Panel will restart and firewall rule updated automatically
Panel domain
Leave blank to use IP address
⚠ After setting, panel accessible only via this domain
Default site folder
New websites created in this directory
🔒
Panel SSL
HTTPS for the panel interface
SSL Certificate
✓ Active
Inactive
Access the panel at:
:
⚠ Enabling HTTPS keeps your custom port — it never switches to the well-known port 443, so the panel stays hidden from generic port scans.
Validity
Domain (leave blank to use server IP)
Let's Encrypt briefly needs port 80 open for domain validation — this is unrelated to your panel's custom port and closes automatically.
⚠ Reconnect your browser to:
🛡
Authentication & Security
Panel login and access control
Google Authenticator (2FA)
Requires verification code on login
Panel password
Argon2id hashed (OWASP recommended)
Authorized IP
Login Audit Log
Last 200 login attempts
Session timeout
Auto-logout after inactivity
hours
🔍
PHP Webshell Scanner
Detect malicious PHP files in site directories
Critical
High
Medium
Files
✓ No threats detected in PHP files
⚙
Panel Settings
General panel behaviour
Auto update panel
Check for VortexPanel updates automatically
Timezone
Server time
Hostname
System packages
Update all installed OS packages
💻
System Information
Server details
✦
AI Assistant
OpenAI-compatible API connection