We attack WebDeck so nobody else can.
Before every release, WebDeck is put through a full adversarial test suite — a hostile tenant and an outside attacker trying every way in, run against both supported web stacks. The latest round ran completely clean.
The protections, and what we prove about each
Every item below is checked by an automated attack that tries to break it. These are the results of the current release's run — not a wishlist.
Tenant isolation
One customer can never read or touch another's files, databases or sites. Enforced at the OS level — every site gets its own Linux identity and its own PHP process, proven on real hardware.
180+ cross-tenant checks · all blockedNo unauthorized access
Every admin and provisioning action refuses missing, forged or expired credentials. A customer's token can't drive operator-only endpoints.
forged + missing creds rejectedNo privilege escalation
A customer account can't reach the admin surface, mint API keys, change roles or impersonate another account. The whole admin area is sealed off.
100+ privilege checks · all blockedInjection-resistant
Usernames, domains, DNS records, cron jobs, IPs and mail fields are validated at the edge. Nothing a user types ever reaches a shell.
command · SQL · mail · DNS · cronNo path escape
The file manager stays inside each site's own folder. Traversal tricks, encoded paths and symlink swaps are refused before any file is read or written.
16 traversal checks · all blockedSecure single sign-on
phpMyAdmin and panel sign-on use one-time tickets that can't be replayed, never travel in a URL, and die the moment the password changes or the user logs out.
replay-proof · revocableSuspension is real
A suspended account genuinely can't act — its sessions go inert, its site stops serving, and old sign-on tickets stop working.
enforced at every layerSigned updates
Every panel update is cryptographically signed. A tampered or unsigned build is refused — a compromised update server can't push code to your panel.
Ed25519 signature verifiedProtected backups
Offsite backups verify the storage server's SSH key before sending anything, and every archive is integrity-checked before it's trusted for a restore.
host-key pinned · integrity-checkedBrute-force protection
Login and two-factor verification are rate-limited and lock out after repeated failures, so a stolen password can't be paired with a guessed code.
rate-limited · lockoutSecrets stay secret
API keys are shown once and never echoed back. Error pages don't leak internals, and backend credentials never reach a customer's view.
no leakage in responsesAbuse & DoS limits
Oversized requests are bounded, account quotas are enforced server-side, and public endpoints are rate-limited against flooding.
quotas enforced · inputs boundedSecurity tools that ship with every WebDeck
You don't install these later or pay extra for them — they're set up and running from day one.
Web Application Firewall
ModSecurity 3 with the OWASP Core Rule Set, tuned per site — SQL injection, XSS, scanners and known exploit patterns are blocked before they reach a site, with an events view and top-rule stats in the panel.
fail2ban brute-force banning
Login, SSH and mail are watched for repeated failures, and the offending IP is banned automatically — so password-guessing attacks get cut off at the source instead of grinding away.
Host firewall (ufw)
The server's firewall is managed straight from the panel, so only the ports you actually use are exposed to the internet — no leftover services sitting open.
ClamAV malware scanning
On-demand virus and malware scanning with ClamAV, kept current by automatic signature updates — scan a site's files for known malware and web shells whenever you need to.
rkhunter rootkit detection
Scans the server for rootkits, backdoors and known server-level compromises, so a break-in that tries to hide itself at the OS level gets caught.
Self-healing reconcile engine
On a timer and after every change, WebDeck walks each managed subsystem, spots drift — a wrong vhost, a missing service, a changed config — and repairs it within minutes, so a server can't quietly slip out of a secure state.
Automatic permission healing
File ownership and permissions are continuously checked and corrected, so a site can't end up world-writable or able to read another account's files after a migration or a bad upload.
Free SSL, automatically
HTTPS certificates are issued and renewed for you via Let's Encrypt — every site gets encryption with nothing to configure and nothing to remember to renew.
Security built into the architecture, not bolted on
Beyond the attack suite, WebDeck is designed so the hard guarantees hold even if something above them fails.
OS-level tenant separation
Each site runs as its own Linux user with its own PHP-FPM pool — so isolation is enforced by the kernel, not just by panel code. Verified live: one site's user cannot read another's files.
Signed updates & licensing
Update manifests are Ed25519-signed and licence responses are HMAC-signed, so a fake or compromised server can't push code or spoof a licence.
Authenticated DNS cluster
Secondary nameservers enrol with single-use, hashed tokens, pin the panel's TLS key, and sync zones over TSIG-signed transfers — no spoofed zone pushes.
Trustworthy backups
Backups pin the storage server's SSH host key before a single byte is sent, and every archive is integrity-checked before any restore is allowed to touch a live site.
Session & SSO discipline
Bearer-token auth (so cross-site request forgery doesn't apply), one-time database sign-on tickets, and sessions that die on logout, suspension or password change.
Independently reviewed
The codebase is cross-checked by multiple independent AI security reviewers each cycle. A recent external 11-point “critical” audit was checked line by line against the real code — every finding was a false positive.
Tested like an attacker, not a checklist
Security on WebDeck isn't a one-off audit. It's a suite that runs against a throwaway copy of the panel before anything ships to a live server — and it has run on every release of the 2.2 line.
A hostile tenant and an outsider
A purpose-built harness provisions disposable accounts and attacks them exactly as a malicious customer or an unauthenticated stranger would — never real customer data.
Apache and Nginx, identically
The same battery runs against both supported web stacks, so isolation and access control hold no matter how the server is configured.
Nothing ships until it's clean
Anything that gets through is fixed, a regression test is added, and the whole suite re-runs. A release goes out only once every attack is blocked.