Chat with us →
Safe by default. Safety Monitor watches, surfaces, and advises — it doesn't touch production without your say-so.
@if(!empty($article['read']))4 min
@endifThe most dangerous thing a security tool can do is take an automatic action on a production server at the wrong moment — kill the wrong process, restart the wrong service, or suspend a paying customer's account over a false positive. Safety Monitor Pro is designed from the opposite direction. It is read-only first: by default it observes and reports, and it does not make changes to your server on its own. This guide spells out exactly what that means.
When Safety Monitor runs, its default posture is to read. It parses logs, reads firewall state, and inspects load and security posture — and it stops there. The dashboards you see are the product of reading signals your server already produces, not the product of changes the plugin has made. Nothing about the default behaviour modifies your configuration, your firewall, or your running processes.
This is the hard line, and it holds across the plugin:
Even when the plugin detects something serious — a sustained attack, a runaway user, a failing security check — it surfaces the finding and recommends a course of action. It does not reach out and take a destructive step by itself.
Anything that does change the server is an action you confirm. If you decide to block an attacker's IP, that deny rule is applied because you chose it — and it's applied through CSF, your existing firewall, where it's visible and reversible. The model is consistent: Safety Monitor proposes, the administrator disposes. There is no hidden path by which the plugin mutates your system without an explicit, confirmed action from you.
Because trust in a security tool depends on accountability, actions taken through Safety Monitor are logged. When a change is applied, you have a record of what was done. That audit trail means you can answer "what changed, and who did it?" after the fact — which is exactly what you want from anything touching a production firewall.
Load Guard (the Cooler feature) watches your server's load average and flags high-consumption users. It's deliberately constrained by a hard safety invariant:
In other words, Load Guard will tell you that a particular user or process is driving load, and it will help you understand the situation — but it will not degrade your customers' sites or take a service offline to do it. Surfacing and advising is the whole job; the destructive lever simply isn't wired up.
Safety Monitor runs entirely inside your WHM. It reads the signals your server already produces and presents them locally. For its core monitoring, nothing leaves the server — your logs, your attack data, and your load metrics are parsed on the box and stay on the box. There is no external monitoring agent shipping your data off-server.
Read-only-first isn't a limitation — it's the point. It gives you the visibility of a full security suite without the standing risk that an automated system does something drastic and wrong to production. You keep the context and the recommendations; you keep the final decision; and you keep a clean audit trail of everything that was actually applied.
This safe-by-default model is core to Safety Monitor Pro. Read the technical documentation for the architecture behind it, or see how it works with CSF and LFD.