DocMon — WAF-Protected Hosting Panel

• ModSecurity v3 web application firewall runs globally in front of every site on the server
• OWASP CRS 4.x plus 18 Marta custom rules against SQL injection, XSS, path traversal and remote code execution
• Blocks access to hidden files and folders such as .git, .env, .svn and .ssh
• Blocks backup/temp files (.bak, .sql, .swp) and config leaks (wp-config, web.config)

+9 more

• Three modes per site: Protect (block), Monitor (log only), Off
• Bulk enable, disable or switch selected sites to monitor mode
• Site-level or global rule ID exclusions for false positives
• Exempt specific URLs from WAF inspection or block them entirely

+3 more

• Attacks / Events screen: blocked and monitored requests per site with rule, IP and request detail
• Ban an IP from an event in one click, or bulk-ban every IP that triggered a rule
• Auto-ban: IPs over a configurable WAF threshold within a time window are blocked at the firewall
• IPs that repeatedly hit the rate limit (429) are also auto-banned

+6 more

• Per-site rate limit: requests per second and burst
• Behind Cloudflare, rate limits apply to the real visitor IP
• Branded "busy" page when the backend is overloaded (flood guard)
• Branded 403, 404 and 429 error pages for all sites

+5 more

• Per-site allowlist (only listed IPs) or denylist mode
• Add single IP or CIDR rules with comments, or paste in bulk
• Presets: Cloudflare, Türkiye, Googlebot, Bingbot, search engines
• Fetch and refresh IP lists from a custom URL

+1 more

• Deep site scan verifies the WAF really blocks live XSS, SQLi, traversal and RCE probes
• Scan checks sensitive files, directory listing, exposed admin panels, cookie flags and TLS
• Bulk security report that scans all sites in parallel
• One-click fixes: HSTS and other security headers, CSP, Secure/HttpOnly cookies, WAF protection

+5 more

• Dashboard: CPU, RAM, disk, WAF status, blocked requests and banned IP count
• New site wizard: Docker-isolated app with optional MariaDB database
• One-step install of WordPress, Laravel, Drupal, Joomla, Symfony, CodeIgniter, PrestaShop, Moodle
• Publish a site from your own docker-compose file or as a reverse proxy to an external server

+7 more

• Browser file manager: upload, download, extract archives, create folders, delete
• File operations are locked to the site's own directory
• One-time browser terminal into a container
• Persistent per-site developer terminal; closed after 3 days of inactivity

+5 more

• Server and site state refreshes automatically every 15 seconds
• Email alerts: site CPU, memory, disk and HTTP availability
• Server memory and disk usage alerts
• Spike filter and cooldown prevent alert noise

+6 more

• One-command install: CloudPanel, Docker, ModSecurity + OWASP CRS, the panel and scheduled jobs
• The WAF module is built automatically for the server's web server version
• Firewall web ports are opened; optional Let's Encrypt certificate for the panel
• The first admin account is created during installation

+2 more