Member Avatar for eltonpiko

Hi

i had a several reseller account in the past and all one the time one of the go hacked and completely mess up my stuff an put stupid pictures instead of my site. I tried everything from changing user name and pass putting something longer but dont know how they manage to still hack it.

anyway now im taking a new vps server which i will be hosting a custom made web app in php which my business will 100% rely on. I can afford for this website to get hack at all.before my resellers account was running cpanel whm.

so please tell me is cpanel not secure should i choose Parallels Plesk Panel instead of cpanel?
should i get a vps with Ms hyper-v with win server2008 then run Apache on it instead of a linux server?

please help me i need a super secure vps and i dont know which one to turn to?

  • 2 Contributors
  • 1 Reply
  • 197 Views
  • 3 Weeks Discussion Span
  • Latest Post Latest Post by Member #682468

Dani AI

Generated

Short answer: neither cPanel nor Plesk is inherently “more secure.” A panel is an extra service that increases attack surface; what matters far more is how the server and application are isolated, kept patched, and monitored. For a business-critical PHP app you should avoid shared/reseller environments (the usual source of cross-account compromises), run the app on a single-tenant VM or managed service, and prefer the OS and toolchain you or your ops team know well. As observed, reducing exposed components helps — if you must use a panel, choose one with strong tenant isolation and a fast vendor patch cadence.

Harden the PHP runtime and isolate apps so a single compromised site cannot escalate to the host or other accounts. Example php.ini highlights to consider (adjust paths, values and removed functions to your app needs):

disable_functions = exec,passthru,shell_exec,system,proc_open,popen,pcntl_exec
allow_url_fopen = Off
open_basedir = /var/www/myapp/:/tmp/
expose_php = Off
cgi.fix_pathinfo = 0
session.cookie_httponly = 1
session.cookie_secure = 1
memory_limit = 128M
upload_max_filesize = 10M
post_max_size = 10M

Run each site under its own low-privilege account (PHP-FPM per-site pools) so PHP processes cannot read or write other sites. Example pool config (replace usernames/groups and socket/user to match your webserver):

[myapp]
user = myappuser
group = myappgroup
listen = /run/php-fpm-myapp.sock
listen.owner = www-data
listen.group = www-data
listen.mode = 0660
pm = dynamic
pm.max_children = 15
pm.start_servers = 3
pm.min_spare_servers = 2
pm.max_spare_servers = 5

Also deploy a WAF (ModSecurity + OWASP CRS or an external WAF like Cloudflare/Sucuri), file‑integrity monitoring (AIDE/OSSEC/Wazuh), regular vulnerability scans (OWASP ZAP/Nikto), offsite versioned backups and tested restores, and strict file permissions (only allow webserver write to upload/temp dirs). Windows + Apache is workable but uncommon for PHP apps; Linux hosting is the standard path and generally easier to harden for LAMP stacks. If you cannot reliably maintain patches and monitoring, pay for a managed provider or a security audit — that investment is cheaper than cleaning a breached production site.

Member Avatar for Member #682468

If you're managing your own server, I wouldn't install a panel. However it is sometimes much easier to administer over a panel, in that case I would say setting up a good quality VPN would be your best bet and configuring your panel to only allow connections from localhost, that way you can use your system credentials to log in and work from the server itself.

Remember to set up SSH on a non standard port, and to use a long passphrase to access your account. If you have the ability, only allow those with absolute need to log in over SSH, root should never be allowed. Grant sudo privliges to those who need it and limit them where possible.

[edit] a panel may also not be where they are getting in, remember to firewall everything you don't need using iptables.

Edited by Member #682468 because: n/a
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.