Checking your server's security at a glance

Server → Security → Overview shows each layer that protects the server, what it has caught, and the latest changes anyone made. Start here when you want to know whether anything needs your attention.

Reading the four cards

Each card opens its own page.

Card	What it shows	Act when
Firewall	On or off, how many extra ports you opened and addresses you blocked, and how many addresses fail2ban has banned for failed sign-ins right now.	It says Off. See the firewall.
Malware	Clean, or how many findings are open across all sites, and the date of the signatures the last scan used.	It shows open findings.
Vulnerabilities	None known, or how many WordPress sites have known flaws, and where the data comes from.	It shows sites.
Spam protection	Whether incoming mail is filtered.	It says Off and you host mail.

Not installed on the Malware card means the Malware Scanning feature isn't on this server; on the Vulnerabilities card, the WordPress Toolkit. Add them on Server → System → Features.

The ban count is normal background noise: servers on the internet are guessed at all day. It's only worth a look when a customer says they can't connect.

Working through open findings

Open findings lists the first five malware findings and the first five WordPress sites with known vulnerabilities, each with a Review link.

• Malware opens Server → Security → Malware, which lists findings on every domain. You can Quarantine a file or mark it Not malware from there, or open the domain to see more. See Dealing with malware found on your site.
• Vulnerable opens Server → Security → Vulnerabilities, described below.

Fixing known vulnerabilities on every site

Server → Security → Vulnerabilities lists each WordPress site with a known flaw in its core, plugins or themes: the severity, the installed version, and the version that fixes it, or "no fix yet". Update on the domain → opens the site's WordPress tab, where Update now installs the fix safely.

Sites fix themselves overnight unless their owner turned that off. See Keeping WordPress secure.

Using a Wordfence Intelligence key

Without a key, Hostctl asks WPVulnerability.net about each plugin, theme and WordPress version in use. A free Wordfence Intelligence key gives you Wordfence's complete feed instead, downloaded once a day and matched on the server.

1. Sign in at wordfence.com and create a key under Account → Integrations → Wordfence Intelligence API.
2. Under Vulnerability data, paste it into Wordfence Intelligence API key and press Save.
3. Press Refresh now to download the data straight away.

The key is stored encrypted and never shown again. To remove it, leave the field empty and press Save: Hostctl goes back to WPVulnerability.net.

Wordfence's terms don't allow sharing a key, so create one for each server you run.

If the line starting Source: says "last refresh failed", the message after it says why.

Finding out who changed what

Latest changes on the overview shows the eight newest events. Server → Security → Audit log has all of them, newest first, 50 at a time: press Older events → for more.

Each line says who acted, what they did, on which domain, and when. Automatic jobs show as Hostctl, and changes made through the API as API: with the client's name. When an admin or reseller acts on someone else's account, their role is shown after their email. Anything that didn't succeed is marked with its outcome.

Narrow the list with:

• What: an area, such as WordPress or Firewall, malware & updates;
• Who: one person;
• Domain: one domain's events;
• Only failures: just what went wrong.

Passwords and keys are never written to the log.