5 security tips for using the free & opensource VPS control panel

The users those are new to Virtual Private hosting, it recommended they should go for one with pre-install hosting control panels such as WHM Cpanel or install some free or open-source VPS host control panel to save some money. However, the main reason for using control panels is to have an ease of handling and managing web servers and databases; along with monitoring and other tasks.

There are many free/opensource VPS host control panels on the market. So many newcomers those to want good performance and a server to handle high traffic of their blog or the website generally opt for VPS but stuck badly if they are not very familiar with the commands. In such situations, a VPS host control panel can help them a lot to improve work efficiency.

Nevertheless, the use of the free VPS control panel has a fatal possibility of security problems. On April 8th, 2018, the VestaCP security vulnerability had caused Digital Ocean servers to suffer from unwanted traffic, thus DigitalOcean has blocked the default port of VestCP i.e  8083 and started allowing it on port 5600.

Although, the popular Linux control panel VestaCP was found to have a 0-day vulnerability, however, some people may insert their hands and feet in the REPO before the stable version tested by the community rigorously.

Whatever, the reason will be, the security while using any free or open-source hosting control panel should be on high priority. Here are some tips we should follow to make sure everything is secure…

Keep eye on VPS CP forums

No matter which free VPS control panel you are using to manage your webserver you should keep visiting respective forums in order to make your self aware about imminent security susceptibilities.

Most of the open-source control panels are community-driven which means a large number of developers and users keep testing them to find out any new bug and report the same on forums. Thus, the administrator should either visit the news section of the installed VPS control panel or forum to know when and how the update patch will available.

Moreover, the official forum will release the patch and update program of the panel first and updating the panel to patch vulnerabilities is the fastest way to reduce losses.

Security of the Virtual Private server itself

The security of the server itself is often ignored by many people. In fact, even if the VPS control panel is doing well, if the security of the VPS itself is not good enough, hardening of the control panel will futile.

To make sure the security of the server itself, the best practise is to buy a VPS  from a trustworthy, big name and with great support. For example GoDaddy, DigitalOcean and many others (just an example we are not recommended any of these VPS).

If there is a problem with the VPS control panel, you can see the clues in the website log. A user can use server log analysis tools such as ngxtop and GoAccess.

In case the server is hacked, one can basically see the exception information from the log + performance monitoring chart, which helps us locate the problem quickly. For performance monitoring, one can use an open-source tool called Netdata. See: how to install Netdata on Windows or Ubuntu. 

Data backup and deployment of remote disaster recovery

We all know backing up of data can save you from any kind of future predicament but how many of us follow it that is the thing.

If you are using any free and open-source VPS hosting control panel then back up of the whole website and Control panel data intermittently should be a habit.

One can also configure some third party cloud drives as VPS host data synchronization to deploy remote disaster recovery backup solutions.

In short, the data is invaluable and in future, if we face a hacking problem, at that time at least we have our website data that can be recovered in the shortest time to reduce downtime.

Recommended not to use pirated plugins or apps

If you are using WordPress, it is recommended not to use pirated or cracked WordPress themes, unofficial plugins, etc. You know nothing in this world nothing is free and why on this earth someone will purchase a paid plugin or theme to distribute free of cost, he must want something; thus such plugins are likely to be pre-embedded with malicious code.

In case you already using some pirated item on your WordPress website, then you should perform a regular virus check on your website program files to ensure that no problems occur. Here are some plugins to remove malware from WordPress.

Give up free, switch to paid or install manually

This tip is rational rather just giving sermons on doing this and that. Yes, if you can afford and want a peace of mind then just go for some paid hosting control panels.

While buying Virtual private hosting, paying some extra bucks can easily give you access to WHM Cpanel with high security. This will not only increase your productivity but also gives access to a lot of software and options related to managing a host/webserver.

Furthermore, if you don’t have money then you should learn how to manage Linux through the command line and manually install Nginx, MySQL, PHP and other building kits directly, safely and securely.

Those VPS panels that have not been updated for a long time without maintenance on the official website are recommended not to be used.

For the veterans, it is recommended to get rid of the impact of the VPS panel as soon as possible, no matter how strong the VPS panel function, as long as you are willing to toss, you can manually use the command to achieve. In addition, imperative scripts can have problems too, such as OpenSSL vulnerability, Nginx vulnerability, etc., all need to pay attention.