Report
Security 360
A service's security month: NGFW threats, SOC findings, blocked countries and bots, code analysis, adaptive WAF, what was done and next month's plan.
SW-S36-… 47 pages
Security 360
Your websites' security, monitored every day
A package per service that brings together all of SWPanel's protections and adds two you won't find standalone: a SOC that analyzes your service daily and a WAF that learns from the attacks you receive. No DNS changes, no plugins, and with any technology.
- 6 protections in hosting
- 12 in Cloud and server
- No plugins or DNS changes
Cloud Web 2 › Incoming traffic · last 30 days
Real screenshot
- Each layer, in its place AntiDDoS at the edge, FW4 and NGFW on our network and Fail2Ban on your server: where each request passes and where it stops.
- Who's knocking at your door People, robots and scans, and which country they come from. In this Cloud, 28 % of the 30-day traffic was scans.
- All of Security 360, in the menu SOC, adaptive WAF, firewalls, Fail2Ban, country blocking and antispam, in the service's own menu.
What it looks like, no mockups
Every request, where it comes from and where it stops
This is the “Incoming traffic” tab of a real Cloud with Security 360, over the last 30 days. 116,643 requests: 28 % were scans looking for open doors and 78 % asked for pages that don't exist. No classic panel shows you this on one screen.
Cloud Web 2 › Incoming traffic
Real screenshot
- How much is scanning. Here, 28 % of traffic looks for known attack paths, not your content.
- Which countries visits come from, sorted by volume.
- Who's asking: people, robots or scanners. Each group with its own color.
- The layers each request goes through: AntiDDoS at the edge, FW4 and NGFW in our network and Fail2Ban on your server.
- How each visit ends: successful, redirected, not found, error or stopped at a layer.
A tour of the layers
Ten screens of the same service, all real
Click each layer to see its screen. They're SWPanel 2027 screenshots with a test Cloud: we've only blurred IPs and machine names.
Cloud Web 2 › Summary
Real screenshot
- Security 360 in the service menu, with each layer and its dashboard.
- Notices with action. Here: 160 GB reserved for snapshots and none taken.
- Status, CPU, memory, disk and snapshots at a glance.
- One tab per topic: resources, services, upgrades, security, traffic, real time and payments.
Cloud Web 2 › Security and backups
Real screenshot
- Each defense with its status. The WAF is in observation: it logs without blocking while it learns.
- One click to the dashboard of each layer.
- Service passwords checked against public leaks.
- Security and vulnerability reports on demand.
Cloud Web 2 › Security and backups
Real screenshot
- Resilience score out of 100: what you could recover if something failed.
- What adds and what subtracts: backups, snapshots, renewal, CPU and RAM headroom, monitoring and passwords.
- Backups and snapshots with what you've ordered, what's missing and the button to do it.
- The improvements that raise the score, one click away.
Cloud Web 2 › SOC › SOC dashboard › Summary
Real screenshot
- A notice that summarizes the status: in order, suspicious or compromised.
- Five figures: services analyzed, worst score, findings, attacking IPs and CVEs.
- Six tabs: summary, findings, trends, code, what to do and consultant.
- Block whoever attacks: 11 IPs try to get in via SSH and the SOC proposes cutting them off.
- To act you type BLOCK. Nothing is applied by an absent-minded click.
Cloud Web 2 › SOC › Consultant
Real screenshot
- What's urgent: what's happening, why it matters and what happens if it isn't fixed.
- Missing protections in your services.
- Each item with its button to go straight to fixing it.
- What costs you performance: server spikes caused by attacks.
- What has changed since the last report.
Cloud Web 2 › Adaptive WAF › Policy
Real screenshot
- Protection mode: here, in observation.
- Threshold: the hits a rule needs before blocking.
- Three modes: off, observation or automatic.
- Three levels of autonomy: only recommends, applies with review or applies without review.
Cloud Web 2 › Next-Gen FW › Threats received
Real screenshot
- 37 threats in 30 days; 81 % of those detected, with a block action.
- Period: from one hour to one year, or custom.
- Where they come from: each IP's country, on the map.
Cloud Web 2 › Fail2Ban › Summary
Real screenshot
- 1,050 blocks this year, 389 distinct IPs and 54 countries.
- The attack map by number of blocked IPs.
Cloud Web 2 › Country blocking › Overview
Real screenshot
- Blocked countries and continents out of 251 and 7.
- Unblocked risky traffic: here, 13 %, from Belgium, Singapore and India.
- The traffic map, country by country.
Cloud Web 2 › Bot blocking › Blocking status
Real screenshot
- 11 bots blocked out of 112 in the catalog.
- 59,812 bot requests in 30 days.
- Status, catalog, traffic, server impact and AI consultant.
- Mode and response: blacklist and 403 error for blocked ones.
- Breakdown by family: AI, copiers, search engines, scanners, SEO, social networks and monitoring.
Watch it in motion
Two security tasks, from start to finish
Short videos made with real SWPanel screenshots. No voice-over: the text of each step explains what's happening.
From the SOC to the action plan
0:20
- SOC overview
- Findings by severity
- AI consultant diagnosis
- What's urgent
- What to do, step by step
Block countries without losing customers
0:16
- Traffic map
- Consultant report
- The question
- Three scenarios
Versus a classic panel
What changes when security explains itself
The usual in cPanel or Plesk
- Each protection on its own screen, with its own language and configuration.
- Advanced features as another vendor's extension with a separate license.
- Raw logs: interpreting what's going on is your job.
- Blocking a country is a yes or a no, without knowing which customers you lose.
In SWPanel with Security 360
- All layers in one package per service, with one menu and one dashboard.
- Daily SOC and adaptive WAF built by us, inside SWPanel.
- An AI consultant that tells you every night what's urgent and what to do.
- Scenarios by country with what you gain and what you lose before deciding.
Why
Websites get updated little and attacked a lot
Most incidents don't come from a sophisticated attack, but from an outdated plugin, a password tried a thousand times or a robot eating up the server. Security 360 watches all that for you and tells you what to do, in plain language.
A single order
All the service's protections under one package and one dashboard. What you already had separately stops being charged.
Real monitoring, not a sign
A SOC that analyzes the service every day, gives it a risk score and proposes a fix for each finding.
It adapts to your website
The WAF rules are born from the attacks your service receives and don't block until they prove they don't bother your customers.
How it works
Layer by layer, all the way to your service
What comes from the Internet goes through the layers from the outside in, and what one stops never reaches the next. SWPanel's SOC and AI engine review every day what has gone through all of them.
SWPanel Data Centers network
-
AntiDDoS Network edge
It watches volume and absorbs massive attacks before they enter the network. Automatic, nothing to configure.
-
Layer 4 firewall SWPanel network
At the perimeter: it looks at IP, port and protocol, and each IP lets through only what its profile allows. Your rules, from SWPanel; your IP blocks are applied on the machine itself.
-
Next-generation firewall SWPanel network
It inspects content by signatures and classifies each threat as critical, high, medium or low. It alerts or drops according to policy.
In front of your server
-
Your provider's network Outside SWPanel
Its DDoS protection and its firewall, whichever your server has contracted.
-
Your server's firewall Your server
The IP blocks you launch from SWPanel are applied on the machine itself.
On your server, with SWPanel
-
Country blocking Your web server
It looks at the IP's country. What you block leaves not a single line in the access log.
-
Bot blocking Your web server
It looks at who each visit claims to be. The robots you don't want get a 403.
-
Adaptive WAF Your web server
It inspects every HTTP request. Its rules are born from your attacks: first they observe, then they block.
-
Fail2Ban Your server
It watches failed logins to SSH and other services, and bans the IP that keeps trying.
Over all of them
-
SOC and AI engine Over all layers
Every day it analyzes what went through all of them, scores your service and tells you what to do, with a button for each thing.
In red, what stops at each layer; in green, what reaches your service.
With Self-Hosted the network is your provider's. What the next-generation firewall used to stop is slowed here by your server's WAF.
The layers, one by oneA request's journey
Filter at the edge, decide on your server, learn every day
- Perimeter AntiDDoS Volumetric attacks
- Perimeter Layer 4 IP, port and protocol
- Perimeter Next generation Threats by their signature
- Server Countries Geographic origin
- Server Bots Robots you don't want
- Server WAF Application attacks
- Server Fail2Ban Brute force on logins
- Core Your website and your data Only what has passed everything gets through
| The analysis finds | Responds in | How |
|---|---|---|
| An application attack pattern | Adaptive WAF | Proposes a new rule, which first observes and then blocks. |
| An IP with a bad reputation | Layer 4 firewall | Proposes blocking it and, once you confirm, blocks it with an end date if you want. |
| Robots or countries that only bring noise | Bot and country blocking | Recommends a profile or the countries to block. |
| Vulnerable code or files | The service itself | Proposes the fix and records it in change control, or isolates the file. |
| Consumption spikes originating in security | Service performance | Cross-checks performance and security and proposes what to fix. |
What's included
6 protections in hosting, 12 in Cloud and server
In Cloud and server the package adds the entire network and machine layer. When you enable it, everything included appears switched on and locked with the label “Included in Security 360”.
| Protection | Hosting | Cloud and server |
|---|---|---|
| Only exist inside Security 360 | ||
| SOC and findings management | Included | Included |
| Adaptive WAF | Included | Included |
| Application and email | ||
| Email antivirus | Included | Included |
| AntiSpam | Included | Included |
| Country blocking | Included | Included |
| Bot blocking | Included | Included |
| Network and machine | ||
| AntiDDoS protection | With the platform | Included |
| Layer 4 and manageable firewall | With the platform | Included |
| Next-generation firewall | Not included | Included |
| Fail2Ban and manageable Fail2Ban | Not included | Included |
In hosting, country and bot blocking can be enabled on their own and for free. When you order the package, the standalone extras it already includes are removed from the invoice: nothing is paid twice.
Inheritance
Protect the Cloud and you'll protect everything it hosts
A Cloud with Security 360 brings the network, antivirus, AntiSpam, countries and bots to all its hostings at no added cost. Those that need their own SOC and WAF, like a store, add their hosting package and inherit the Cloud's policy.
Three modes
Protection grows with what you have ordered
SWPanel works out each service's mode and changes it on its own as soon as you order or cancel something, without losing the configuration.
| Standalone (hosting only) | With Security 360 | Security 360 + AI module | |
|---|---|---|---|
| Country blocking | World map, blocking by country and continent, profile with each country's risk | Plus traffic by country, firewall attacks, recommendations and profile with visits | Plus a consultant with three scenarios and questions about your business |
| Bot blocking | Catalog of 112 bots, blocking profiles, block and allow with one click | Plus custom rules, uncataloged bots, bot traffic and server impact | Plus bot-by-bot consultant and spike analysis |
| SOC and WAF | They don't exist outside the package | Daily SOC, findings management and adaptive WAF | Plus a security consultant in six blocks |
- 342,000 Scored CVEs with more than 10 sources
- 251 countries with a risk index by country and continent
- 96 cataloged bots in 7 families
- 200 services per Cloud SOC the Cloud and everything it hosts
Compared
What a plugin or a per-site WAF doesn't give you
Versus Sucuri, Wordfence, Cloudflare or Imunify360, Security 360 adds a daily SOC with risk scoring, AI-proposed and validated WAF rules, and protected email. And a Cloud protects everything it hosts. Want a CDN too? SWPanel enables Cloudflare's Free plan on your hosting and you manage it from SWPanel.
Documentation
Take the detail with you
SWPanel 2027 modules guide
What Security 360 includes for each type of service, its layers, the SOC, the WAF and inheritance.
Business lines
Managed cybersecurity and a worry-free website: how to sell it under your brand.
The month's report
Security 360, as a PDF
What the eight layers have seen and done in a service, with next month's plan. And the firewall report separately.
Report
NGFW firewall threats
What the NGFW detected and blocked in a period: by severity, type and origin, the changes over the last six months and what to do first.
SW-NGF-… 29 pages
Each document carries a unique number and token linking it to the original stored in SWPanel. How it's verified.
Frequently asked questions
Questions about Security 360
The Security module is activated once on the account and opens the door. 360 Security is the package that works every day on each hosting, Cloud or server, and is paid per service.
No. 360 Security works on the server itself: it is activated from SWPanel and works with any technology, not just WordPress.
No. It is an automatic daily scan (light every day and full every week) with a risk score, findings and a button to resolve each one. If you want a human response to incidents, your partner can offer it as a service.
No. 360 Security works without it, and the AI that writes the WAF rules is already included. The AI module adds the security, country and bot consultants.
The package keeps working until the end of the paid period and you keep all your settings in case you come back.
Activating the Security and SEO modules on your account is free. Afterwards you choose which services you protect with 360 Security and which SEO tier each website has.
You activate the Security module once on your account and then subscribe to 360 Security on each service you want to protect: there is one package for hosting and another for Cloud and server. See the pricing page.
Only what is reversible and free, always with an end date and an undo button. Anything that has a cost is proposed and you approve it.
The service goes back to the base mode and you keep all of your configuration, so you can recover it if you activate it again.
Start with one website and see what it finds
Enable Security 360 on a service and get its first analysis that same night.