Hosting panels
The InfraFence plugins for cPanel & WHM (available) and Plesk (in development) - what they show, what they need, how they talk to the agent, and what they never store.
Last updated:
The InfraFence plugins bring protection status, bans, malware findings, security events and per-site scans into WHM and Plesk, for the hosting teams who already manage servers from there.
Available (cPanel & WHM). Organizations on Basic, Pro or AutoMode can install the WHM plugin from the dashboard: Panel plugins › cPanel & WHM. See WHM plugin.
In development (Plesk). The Plesk extension is not ready for production servers yet: write to info@infrafence.com if you want to try it.
What they need
- The InfraFence agent 1.0.32 or later installed on the server first (Quick start). Without it, the plugin shows how to add the server. The attack map and the security score in WHM need agent 1.0.33 or later. Open and resolved problems in WHM need agent 1.0.34 or later and WHM plugin 1.0.2.
- cPanel & WHM 11.110 or later, or Plesk Obsidian 18.0.60 or later on Linux.
The plugins are included in the Basic, Pro and AutoMode plans at no extra cost: you pay per server as for any other server. Starter does not include them. If payment stops, the plugin shows no data from the 72-hour stop until the plan is active again (Billing and plans). Every screen of the WHM plugin then says why, with all figures at 0, empty lists, no map or score, and the actions off: see WHM plugin. With agent 1.0.34 or later the agent itself also refuses the data and the actions (command reference). The plugins are source-available under BSL 1.1, like the agent, at github.com/infrafence/infrafence-panels.
Seven screens
The same in both panels. The WHM plugin's Overview also shows the security score, the critical events and the attack map: see WHM plugin.
| Screen | What it shows and does |
|---|---|
| Overview | Protection status, agent version and last heartbeat, plan, AutoMode, a link to the server in the dashboard. |
| Bans | Every banned address with its reason and source. Unban it on this server only, or add it to the whitelist. |
| Whitelist (Allow list in Plesk) | Addresses never banned, from the panel and from the dashboard. Add and remove the panel's entries. |
| Findings | Malware and file integrity findings; in WHM, with the resolved ones marked. |
| Events | Recent security events; in WHM, open or resolved, filtered by state and by severity. |
| Coexistence | The other security tools found on the server, and what InfraFence does next to each. See Coexistence. |
| Sites (Domains in Plesk) | Accounts, domains and document roots, with their scan coverage. Scan a site now. |
How they work
The plugins hold no credentials and open no network connection: they run infrafence-agent panel <command> --json as root, and the agent answers over a local socket only root can open (/run/infrafence/panel.sock). See the command reference. The attack map and the security score come from the dashboard through the agent, which fetches them and keeps a copy: the plugins still hold no token.
- Every change (unban, allow, remove, scan) asks for confirmation first, and is reported to the dashboard as an event with source
paneland the panel user who made it. - An unban from the panel lifts the ban on this server only, for at most 30 days. The ban stays in the dashboard and on the organization's other servers, and a new attack bans the address again.
- Addresses allowed from the panel are added to the whitelist until they are removed from the panel.
Install guides: WHM plugin and Plesk extension.