WHM plugin

The plugin appears in WHM » Plugins » InfraFence. It is included in the Basic, Pro and AutoMode plans and installed from your dashboard. On Starter, or after the 72-hour stop when a payment fails, it shows no data until a paid plan is active. See Plans. The current version is 1.0.2.

Requirements#

• An InfraFence organization on Basic, Pro or AutoMode, and the InfraFence agent on the server (the plugin installs without it, and then shows how to add the server).
• cPanel & WHM 11.110 or later, as root.
• For the attack map and the security score on the Overview: agent 1.0.33 or later. With an older agent everything else works, and the Overview says to update the agent.
• For open and resolved problems: agent 1.0.34 or later and plugin 1.0.2. With an older agent every event counts as open, as before.
• For the update notice: agent 1.0.35 or later and plugin 1.0.3. With an older agent the plugin shows no notice; Technical details still show both versions.

Install#

1. In the dashboard, open Panel plugins › cPanel & WHM.
2. Pick the server's system and copy the install command:
   • RPM for AlmaLinux 8, 9 and 10, CloudLinux and Rocky (dnf install, or yum install where there is no dnf);
   • .deb for Ubuntu 24.04 (apt install);
   • Tarball, unpacked and installed with ./install.sh.
3. Run it on the server as root.

The command downloads the package and the release's SHA256SUMS with a link that works for one hour, checks the package with sha256sum -c, and installs it only if the checksum matches. When the link has expired, New link on the same page gives a fresh command.

The installer checks the server first (cPanel version, root, free space, the Perl modules WHM provides): if a check fails, nothing is changed. With the tarball, ./install.sh --check only runs the checks. Services are never restarted. Running it again replaces the plugin in place, which is also how you update it: see Updating the plugin.

Updating the plugin#

The plugin is updated from the dashboard, separately from the agent: updating the agent, by hand or automatically, never updates the plugin. The agent's version and the plugin's are different numbers: Technical details on the Overview shows both, Agent version and Plugin version.

To update the plugin:

1. In the dashboard, open Panel plugins › cPanel & WHM.
2. Copy a fresh install command for the server's system. The link in it works for one hour; New link gives another.
3. Run it on the server as root. It checks the package and replaces the plugin in place; each WHM user's language choice is kept, and no service is restarted.

When an update is available (agent 1.0.35 or later, plugin 1.0.3 or later): the agent reads the installed plugin's version (read only, from /usr/local/share/infrafence-whm/VERSION) and reports it to the dashboard, and the dashboard sends the agent the latest release. Then:

• in WHM, every screen of the plugin shows A new version of the plugin is available (1.0.4). Update it from the InfraFence dashboard › Panel plugins, and Plugin version says 1.0.4 available;
• in the dashboard, the server's page says WHM plugin 1.0.3 — update available (1.0.4) with Update the plugin, and the server has a WHM plugin update badge in Servers. When the plugin is current, the server's page says WHM plugin 1.0.4 — up to date.

The notice and the button are shown only on the plans that include the plugin.

The Overview#

The Overview says first whether the server is all right:

• At a glance: the protection status, the security score out of 100 with its grade, and one line that says whether anything needs your attention. Open in InfraFence opens the server in the dashboard.
• Key figures: attacks and critical events in the last 24 hours, active bans, findings to review.
• Needs attention: the critical events of the last 24 hours, and what takes points off the security score, with its change over 30 days and Fix these in InfraFence.
• Where the attacks came from: a world map of the countries this server's attacks came from, over 24 h or 7 days, with the top sources and the attack types. Counted per country: no addresses are shown.
• Technical details: agent version and plugin version, service, last heartbeat and sync, connection, server ID, hosting panel, plan, mode and AutoMode.

Resolved problems (agent 1.0.34 or later): a problem resolved in the dashboard or by the agent, such as a database port closed or a file quarantined, no longer counts in the key figures, in the critical events or in Needs attention. Below the open ones, the Overview lists the three problems resolved most recently in the last 24 hours, each with a green line saying how and when, for example Resolved · port closed · 10:50 UTC; Show resolved (N) opens the rest on the Events page. When everything of the last 24 hours is resolved, it says Nothing open: the problems of the last 24 hours are resolved.

The dashboard computes the map and the score from this server's reports. The plugin asks the agent for them (panel map and panel score); the agent fetches them from the dashboard and keeps a copy, asking at most every 5 minutes for the map and every 15 minutes for the score. When the dashboard cannot be reached, the Overview shows the last copy and when it was made. The plugin itself still holds no token and sends no request to any other site: the map is drawn on the server and needs no JavaScript.

Events has a State column: Open, Resolved with how and when, or a dash for events that are not problems, such as attacks and scans. It filters by state, All, Open or Resolved, and by severity, All, Warning and above or Critical. Findings marks a resolved finding with a green Resolved label, how and when.

Plans#

The plugin shows data only when the organization is on Basic, Pro or AutoMode and protection is on. Otherwise every screen says why at the top, with all figures at 0, empty lists, no map and no score, and the actions off:

The plugin reads the plan from the agent's panel status (with agent 1.0.34 or later, the agent's own entitlement), then asks the agent for nothing else and refuses every action before it reaches the agent. This never changes the server's protection. The agent keeps the last plan it received, so a dashboard outage does not blank the plugin.

What it installs#

All owned by root and writable only by root.

Who can open it#

Root only (and WHM users with the all privilege). Resellers and cPanel users never see it: the agent's data covers the whole server. The plugin follows WHM's language: English, Italian, Spanish, French, German or Portuguese. Each WHM user can pick another one with Language at the top of the plugin; Same as WHM goes back. The choice is kept per WHM user, readable by root only.

Safety#

• Every change shows a confirmation page first and runs only with WHM's session security token.
• The agent is run directly, with no shell, a clean environment and a time limit; its binary must belong to root.
• Open in InfraFence opens the dashboard without sending a referrer.
• The plugin holds no InfraFence token and opens no network connection: the agent answers it over a local socket, and fetches the map and the score from the dashboard itself.

Remove#

dnf remove infrafence-whm

apt remove infrafence-whm

For the tarball install: /usr/local/share/infrafence-whm/uninstall.sh (--check shows what it would remove). Removing the plugin never touches the agent.