Safety Monitor
Pro

Minimal. Safety Monitor is event-driven and log-driven, not a resident polling daemon — it does not hold a persistent process. Dashboard metrics are read on page load, and background work is limited to short, throttled cron tasks (incremental log parsing and a periodic GeoIP refresh). Log parsing is bounded and reads new lines incrementally, so it does not re-scan large audit logs from scratch. On a typical WHM server the steady-state overhead is negligible.

No — it is complementary, not a replacement. Safety Monitor reads your existing CSF/LFD state and, only when you confirm an action, can add allow or deny rules through CSF. It does not run its own competing firewall and does not fight LFD over the same rules. On first entry it offers to allowlist your current admin IP so a firewall rule can never lock you out of your own server.

Yes. It runs alongside Imunify360, CloudLinux, and similar suites — it reads shared signals such as the ModSecurity audit log and focuses on visibility plus load safety, so it does not compete for the same enforcement layer. To be clear: we are not affiliated with, partnered with, or certified by CloudLinux, Imunify360, or LiteSpeed — “runs alongside” simply means it coexists without conflict.

Yes. It installs as a native WHM plugin via AppConfig and runs at the WHM (root) level, because reading server-wide logs, load metrics, and firewall state requires that access. It is a server administrator (WHM) tool, not a per-cPanel-account add-on.

The signals your server already produces: the ModSecurity audit log (for intrusion detection), CSF/LFD state, cPanel/Apache access logs, and system load metrics from /proc. It also uses a self-contained GeoIP country/ASN database for Country BlockGuard, which requires no external API key. It reads these sources — it does not modify them.

No. It is read-only first and safe by design. It monitors, classifies, and recommends, but it never restarts services, kills PHP, or suspends accounts on its own. Load Guard (Cooler) throttles gently under CPU spikes and never terminates site processes. Every corrective action requires your explicit confirmation, and every action is logged.

It classifies suspicious activity by pattern — grouping ModSecurity events into attack types (SQLi, XSS, LFI, RCE and similar), flagging brute-force and repeat offenders, and scoring per-domain risk. The output is read-only, safe-by-default recommendations and prioritized alerts, not automatic enforcement. You review the analysis and decide what, if anything, to act on.

A server running cPanel & WHM on a supported Linux distribution (for example AlmaLinux, Rocky Linux, or CloudLinux) on a VPS or dedicated server, with PHP available in WHM. It is designed for current, supported cPanel/WHM releases. If you are on a supported cPanel version, it installs as a standard WHM plugin.

Instantly. On successful payment your plugin license is issued and your plugin download appears immediately in your customer portal — there is no manual waiting step. You then run the WHM installer and activate the license inside the plugin.

Yes to the move, no to the data. Licenses are keyed to your server IP and are transferable when you migrate to a new IP or server. And no monitoring data leaves your server for analysis — there is no external agent or off-box telemetry collecting your logs; the dashboard, parsing, and AI classification all run locally within your WHM.