Security at OS level, not just in the panel.
enconf isolates customers on multiple layers. A compromised PHP process cannot read another customer — that is architecture, not a feature.
- Linux user per customer
- PHP-FPM pool per customer
- open_basedir + disable_functions
- nftables + fail2ban
- open_basedir + disable_functions
- ProFTPD chroot
Security on all layers
From Unix DAC to AppArmor — multi-layer defense without manual configuration.
Customer isolation (Linux user)
Every customer gets their own UID/GID, own directories with 0710 user:www-data.
PHP-FPM pool per customer
PHP runs with customer identity, open_basedir + disable_functions.
nftables firewall
Default-deny plus a GeoIP country filter for IPv4 & IPv6 — in block or allow mode, whole continents & zones (EU, DACH, EU+CH+UK) in one click. Allowlist for search-engine bots, editable rules with multiple IPs, SMTP egress block — and Let’s Encrypt always stays reachable.
fail2ban
Brute-force protection for SSH, FTP, mail, panel login.
Upload protection
Blocks PHP execution in upload directories — closes the most common WordPress hack pattern.
Secret hygiene
Panel secrets root-only (0600). Customer PHP cannot read JWT_SECRET.
WAF (ModSecurity/OWASP CRS)
Blocks SQL injection, XSS and path traversal at the Nginx layer — enable it per site without affecting any other customer.
Security advisor in the panel
Continuous audit of all security layers with score, issues and one-click fix.
In detail
- Linux user + UID/GID per customer
- PHP-FPM pool per customer
- open_basedir + disable_functions
- Per-customer /tmp (0700)
- Webroot 0710 user:www-data
- nftables: editable rules, multiple IPs per rule, SMTP egress block
- fail2ban for SSH/FTP/mail/panel
- GeoIP country filter: block/allow, continents & zones, bot allowlist
- Nginx upload-path PHP block
- ProFTPD chroot ~
Security that works by architecture.
14-day free trial · No credit card · Made in Germany
View pricing →