Security
Nodekeeper came out of day-to-day production operations and customer security reviews. That's why isolation, access control, web protection, operation records and recovery get so much attention. This page lists the actual controls, the plans that include them, and where each one stops.
Site isolation, the base WAF, core access checks and operation records are in every plan, Free included. Paid plans build on that baseline with deeper traffic controls, log viewers, collaboration and tamper protection.
../ and absolute paths. A website backup restores only into that site's own directories.In testing on 2026-11-03, the November 2026 release refused every cross-member request: sites, files, tasks, SSH grants, FTP, PHP pools and logs, backups, domains, WAF logs, reverse proxy and forwarding. The isolation check script passed 72 of 72 checks.
Customers and colleagues get their own panel accounts. Nobody needs to share the administrator login.
User groups, role permissions and delegated administration for teams.
Configure the host's SSH service, keys and two-factor authentication from the panel. Operations that cannot be undone ask for a fresh 2FA code.
Rolling back a storage snapshot requires 2FA and a disk that is not in use. A snapshot of the current state is taken automatically first.
ModSecurity rule sets for your sites, managed in the panel.
Host firewall rules and port forwarding (iptables, frp, SSH) are managed from the same panel.
Rate limits, IP and GeoIP rules, a human check in front of a site, and JA3 client-fingerprint rules.
On every plan, Free included, panel operations are recorded with the account, the permission used, the request path and the source IP. Forged X-Forwarded-For / X-Real-IP headers are ignored, so the recorded address is the real one.
The website-log and WAF-log viewers start at Personal. Paid plans add viewing and analysis tools. Free still records operations.
An eBPF LSM program in the kernel protects the files and directories you select, according to the policy you set.
Nodekeeper provides technical controls: isolation, permissions, WAF, operation records and recovery tools. Installing it does not by itself make a deployment pass a security audit or a compliance review.
Every user can report a security issue, on any plan, including Free. Write to [email protected] with the version, a description and the steps to reproduce. Please do not send passwords, private keys or customer data.