Security Model

HostGuard runs inside your existing WHM as a native plugin. It is designed around a single principle: a monitoring tool should make your server safer without ever making it less available. Everything below describes how the plugin behaves out of the box.

Read-only by default

HostGuard is fundamentally an observer. It reads the signals your server already produces — the ModSecurity audit log, CSF/LFD state, cPanel access logs, and /proc load metrics — and presents them in a live dashboard. In its default posture it does not modify your system. It surfaces what is happening and tells you what it recommends; it does not silently change configuration, rewrite files, or alter services on its own.

No automatic restarts

HostGuard never restarts, stops, or throttles services — not Apache, LiteSpeed, MySQL, PHP-FPM, or your site's PHP. Under high load its Load Guard (Cooler) surfaces the users and processes driving the load and advises on next steps, but it will not bounce a service or kill a workload behind your back. Availability is never sacrificed automatically.

No automatic deletions or suspensions

HostGuard never deletes files, never suspends accounts, and never terminates user processes automatically. If a domain is under attack or an account is behaving abnormally, the plugin flags it and recommends an action — the destructive part is left to you. There is no code path that removes data or cuts off a customer without an explicit human decision.

Admin confirmation required for any corrective action

Any action that changes the state of the server — adding a firewall block, allowlisting an IP, applying a hardening tweak — is a deliberate, admin-initiated step. The plugin presents the recommended change and waits for you to confirm it. Nothing corrective happens as a side effect of simply opening a page or leaving the dashboard running.

Full audit logging

Every corrective action taken through HostGuard is logged with context — what was changed, when, and the reason recorded at the time (for example, the block reason attached to a firewall rule). This gives you a clear, after-the-fact trail of every change the plugin helped you make, so nothing is opaque and every action is accountable.

Permissions model

HostGuard installs as a WHM plugin and therefore runs with root-level reach — that is unavoidable for a server-security tool that reads privileged logs and manages the firewall. What matters is how it uses that reach:

• Read-only-first. Privileged access is used primarily to read — logs, firewall state, load metrics. Writes happen only when you confirm a specific corrective action.
• Never-block-self. The plugin will not lock you out of your own server. On first entry it offers to allowlist your current admin IP so a firewall rule can never cut off your access.
• Bounded scope. When it does add rules, it works through CSF rather than around it, and it does not replace or fight your existing firewall and security stack.

Data privacy

Your monitoring data never leaves your server. HostGuard parses logs and metrics locally and renders them in your own WHM — there is no external monitoring agent shipping your traffic, attack data, or account information off-box. The only outbound contact is license validation against the official license service; your operational and customer data stays on your machine.

Want the deployment details behind this model? See the technical documentation and the compatibility list, or read the full Trust & Verification hub. Still unsure? Message us during business hours and we will walk you through it engineer-to-engineer.