Server security — Paylood Documentation

The Security module analyzes and hardens your servers with an overall score, then applies the protections in one click.

Opening the security dashboard

From the Servers page, click Security on the server card. You get:

An overall security score and a status (SECURE, WARNING or CRITICAL).
The state of each protection (active or not).
The Harden server button to apply missing protections.

Capture à venir

en/servers-security

Cette capture illustrera la vue correspondante. Elle est générée automatiquement par le pipeline Playwright.

Server security dashboard

Applied protections

Firewall (UFW)

Automatic UFW firewall configuration:

Default policy: all incoming traffic is denied (deny incoming), outgoing traffic is allowed.
Allowed ports: the SSH port (22 by default, or the port you configured), 80 (HTTP) and 443 (HTTPS).
Firewall enabled with ufw --force enable.

Warning

The SSH port is kept open so you are not locked out of the server. If you change the SSH port manually, update the rule before dropping the default port.

Fail2ban

Protection against SSH brute-force attacks: after 5 failed login attempts within a 600-second window, the source IP is banned for 3600 seconds (1 hour). The configuration is written to /etc/fail2ban/jail.local (sshd jail).

Anti-mining protection

Blocks well-known cryptomining ports on the DOCKER-USER iptables chain: 3333, 4444, 5555, 7777 and 14444. This prevents compromised containers from receiving mining instructions.

SSH authentication

Paylood does not modify your sshd_config. The module only checks your authentication method:

If your server uses a private key, your score increases by 20 points (recommended).
If your server uses a password, a recommendation invites you to switch to a private key (isPrivateKeyRecommended is shown in the dashboard).

Score and statuses

Protection	Points
UFW firewall active	30
Fail2ban active	30
Anti-mining active	20
Private key authentication	20

The total score (out of 100) determines the status:

Status	Score	Meaning
`SECURE`	≥ 80	Protections applied and verified
`WARNING`	50 – 79	Some protections missing
`CRITICAL`	< 50	Vulnerable server — harden it

Recommended workflow

Connect your server (see Connect a VPS).
Open Security.
Click Harden server.
Check that the score turns green (SECURE).
(Optional) Re-harden after any sensitive server change.

The protections are idempotent: re-running the hardening does not create duplicate rules and does not break existing configurations.

On error

Each failed protection shows a diagnostic. Common causes:

ufw already configured differently by another tool.
Custom iptables rules that conflict.
fail2ban not installable (non-Debian distribution) or blocked service.

Fix the indicated error or reset the related setting, then re-run the hardening.