A compromised Virtualizor master gives an attacker control over every VPS on your platform. A few hardening steps on the panel and the host nodes greatly reduce that risk. This checklist is for administrators running their own Virtualizor installation.
Before you start
- Root access to the master and nodes, and out-of-band access (IPMI) in case a firewall change locks you out.
- A list of your fixed admin IPs or VPN ranges.
Protect the admin panel
- Restrict by IP: in Configuration → Master Settings (or security settings), limit admin panel login on port 4085 to your office or VPN IPs.
- Two-factor authentication: require it for all admin accounts.
- Separate staff accounts: no shared root login – create admin users with ACLs; see users and ACLs.
- Valid SSL: install a certificate for the panel hostname in Configuration → SSL Settings so browsers never teach staff to ignore warnings.
- Session timeout: shorten idle sessions.
Firewall the nodes
| Port | Purpose | Allow from |
|---|---|---|
| 4081–4083 | End-user panel and API | Everyone (customers), or your billing system only for the API |
| 4084–4085 | Admin panel | Admin IPs only |
| Master–slave communication | Panel ports | Master and slave IPs only |
| VNC range | Customer consoles | As required by your noVNC setup |
| 22 | SSH | Admin IPs only |
Apply rules with firewalld, nftables or CSF on each node, and test from outside before closing your session.
Secure SSH on nodes
- Use SSH keys and disable password login (
PasswordAuthentication no). - Disable direct root login or restrict it to keys (
PermitRootLogin prohibit-password). - Enable Fail2Ban for SSH; see Fail2Ban jail settings.
Protect API credentials
- Create separate API keys per integration (WHMCS, scripts) and restrict each to its source IP.
- Rotate keys when staff change, and delete unused keys.
Isolate VPS traffic
- Enable IP and MAC anti-spoofing so a VPS cannot use addresses that are not assigned to it.
- Rate-limit outbound traffic per plan to limit damage from compromised VPS.
- Monitor abuse reports and suspend VPS that send spam or attack others.
Keep everything patched
Apply panel updates and host security updates regularly, and reboot nodes for kernel updates in planned windows; see updates and maintenance.
Monitor
- Review admin login logs and task logs for actions you did not expect.
- Alert on unusual CPU, network or disk activity on nodes.
- Keep off-site backups of VPS and the master's database.
Troubleshooting
- Locked out after IP restriction: use IPMI or SSH from an allowed IP to edit the setting.
- Customers cannot open VNC after firewalling: allow the VNC/noVNC ports again.
- WHMCS stopped provisioning: the API port or key IP restriction now blocks the billing server.