Securing a cPanel & WHM server with InfraFence: a real case

A real case, anonymised: one of our own production cPanel & WHM servers, run by the company behind InfraFence, on 24 and 25 October 2026. The figures are what this server showed, in our case; another server will show different ones.

System

AlmaLinux 8.10, cPanel & WHM 138

Accounts and sites

5 cPanel accounts, 19 sites

Already on the server

cPHulk, fail2ban, ModSecurity and ImunifyAV

First 24 hours

About 285 attacks, about 98% of them port scans

1. Install, in minutes. The agent and then the WHM plugin. The agent found cPHulk, fail2ban, ModSecurity and ImunifyAV and worked next to them: nothing was restarted and no service was touched during the install.
2. The first 10 minutes. The first port scanners were banned.
3. The first check. 26 of the 50 hardening checks had something to fix, and the security score was 74 out of 100, grade C.
4. A critical event: Database reachable from the internet. MySQL's port 3306 answered from the whole internet. We closed it from the dashboard: the port was closed in under 2 seconds, then the agent checked that SSH and all 19 sites still answered, and they did. The event now shows as Resolved.
5. A file change. The file-integrity watch reported a change to /root/.ssh/authorized_keys: an administrator had removed an old key. The analysis rated it low risk, keys removed rather than added, and we marked it as expected.
6. After 24 hours. About 285 attacks seen, about 98% of them port scans, mostly from France and Canada. At one point 91 addresses were banned at once.

In WHM, root sees the same day on the plugin's Overview: the score and its grade, the critical events of the last 24 hours, what takes points off the score, and a map of where the attacks came from. Open in InfraFence leads to the server's page in the dashboard, where the port was closed.

The plugin lives under WHM » Plugins » InfraFence. These screenshots are rendered from the plugin with sample data, not taken from the server above.

• Bans

  Every banned address with its reason and source. Unban it on this server only, or add it to the whitelist.

  

• Events

  Recent security events: what happened, how serious it is and where it came from.

  

• Findings

  Malware and file-integrity findings on the server, with severity and status.

  

• Sites and domains

  Every account's domains and document roots, whether the scheduled malware scan covers them, and Scan now for a single site.

  

• Coexistence

  The other security tools found on the server, and what InfraFence does next to each one.

  

Every screen and its options are in the WHM plugin guide; the cPanel & WHM integration page explains how the plugin talks to the agent.

• cPanel's configuration stays cPanel's. The agent keeps to its own firewall chains. It never edits csf.conf, csf.allow or csf.deny, adds no ModSecurity rules under cPanel, leaves cPHulk unchanged, and leaves Imunify360's firewall, address sets and web firewall alone.
• Root only. The plugin shows every account on the server, so only root sees it. Resellers and cPanel users never do.
• No credentials in the panel. The plugin stores no InfraFence key or token: it asks the agent on the same server, over a local socket only root can open.
• Every change confirmed and recorded. Unban, allow and scan ask for confirmation, and each one reaches the dashboard as an event with the name of the WHM user.
• Changes checked, or undone. When a port is closed or a fix applied, the agent checks SSH and your sites afterwards and rolls the change back by itself if something stopped answering.

Details for each tool are in Coexistence.

InfraFence is not the only security product inside WHM: Imunify360 has a full WHM integration, CSF has its WHM page, and BitNinja and CrowdSec have WHM plugins too. General Linux tools such as fail2ban, Wazuh or OSSEC do not come with a WHM plugin. What InfraFence brings is a full security view inside WHM and one dashboard for all your servers, at a flat price per server.

As of October 2026, from the vendors' public documentation and pricing pages. Prices change: check them before you decide. Each comparison in full: CSF, Imunify360, fail2ban.

Where Imunify360 is stronger. Proactive Defense watches PHP scripts as they run, which InfraFence does not do, and Imunify360 is built by the CloudLinux team and fits cPanel and CloudLinux closely, with screens for hosting customers and automatic malware cleanup. If you sell shared hosting, keep it: InfraFence runs next to it.

The WHM plugin is included in the paid plans, at no extra cost: Basic $8.90, Pro $18.90 and AutoMode $28.90 per server per month, 20% less billed yearly, the same for 1 account or 300. Starter, free for one server, does not include the plugin. Every new account starts with 14 days of AutoMode free, no card. See Pricing.

1. Create your account and add the server: Servers › Add server gives a one-line install command to run as root. It checks the server before it changes anything.
2. In the dashboard, Panel plugins › cPanel & WHM gives the plugin's install command: the RPM for AlmaLinux 8, 9 and 10, CloudLinux and Rocky, the .deb for Ubuntu 24.04, or the tarball. cPanel & WHM 11.110 or later.
3. Open WHM » Plugins » InfraFence.

More for hosting teams on the hosting page.