# Security Tab

## Member Security

**<span class="font-semibold" data-streamdown="strong">Tab:</span> <span class="font-semibold" data-streamdown="strong">Security</span>.**

Use the **Security** tab to check and manage host-level firewall and SSH access for one server in a hosting pool. It is for server access control, not website, database, or cPanel account security.

[![Member-Security.png](https://docs.serversctl.com/uploads/images/gallery/2026-07/scaled-1680-/member-security.png)](https://docs.serversctl.com/uploads/images/gallery/2026-07/member-security.png)

### What you can do

<div class="ui-scroll-area" data-direction="horizontal" data-scroll-padding="4" data-visibility="hover" id="bkmrk-area-what-it-is-for-"><div class="ui-scroll-area__viewport"><div class="ui-scroll-area__content"><div><div><table><thead><tr><th>Area</th><th>What it is for</th></tr></thead><tbody><tr><td>**Firewall status**</td><td>See whether a supported firewall backend is detected, which backend is in use, whether it is enabled, and when the rule list was last refreshed.</td></tr><tr><td>**Security actions**</td><td>Refresh firewall rules, enable or disable the firewall, manage SSH access, back up firewall rules, and add firewall rules.</td></tr><tr><td>**Firewall rules**</td><td>Review the latest stored rule snapshot and delete rules when needed.</td></tr></tbody></table>

</div></div></div></div></div>Supported firewall views are based on what the member reports, commonly UFW or firewalld.

### Free and Pro

<div class="ui-scroll-area" data-direction="horizontal" data-scroll-padding="4" data-visibility="hover" id="bkmrk-feature-community-pr"><div class="ui-scroll-area__viewport"><div class="ui-scroll-area__content"><div><div><table><thead><tr><th>Feature</th><th>Community</th><th>Pro</th></tr></thead><tbody><tr><td>View firewall status from the latest member report</td><td>Included</td><td>Included</td></tr><tr><td>View SSH status from the latest member report</td><td>Included</td><td>Included</td></tr><tr><td>View stored firewall rule snapshots</td><td>Included</td><td>Included</td></tr><tr><td>Refresh firewall rules</td><td>Upgrade required</td><td>Included</td></tr><tr><td>Enable or disable firewall</td><td>Upgrade required</td><td>Included</td></tr><tr><td>Add firewall rules</td><td>Upgrade required</td><td>Included</td></tr><tr><td>Delete firewall rules</td><td>Upgrade required</td><td>Included</td></tr><tr><td>Enable or disable SSH service</td><td>Upgrade required</td><td>Included</td></tr><tr><td>Back up firewall rules</td><td>Upgrade required</td><td>Included</td></tr></tbody></table>

</div></div></div></div></div>Community gives visibility. Pro gives controlled action: rule changes, firewall state changes, SSH access control, and firewall backups before risky changes.

#### Firewall status

Open **Pool**, choose the member, then select **Security**.

The firewall status area shows:

<div class="ui-scroll-area" data-direction="horizontal" data-scroll-padding="4" data-visibility="hover" id="bkmrk-whether-a-supported-"><div class="ui-scroll-area__viewport"><div class="ui-scroll-area__content">- Whether a supported firewall was detected.
- The firewall backend, such as UFW or firewalld.
- Whether the firewall is enabled or disabled.
- When the rule snapshot was last refreshed.

</div></div></div>If the firewall is not detected, the member may not have a supported firewall installed or the agent may not have enough information yet. Refresh rules after fixing the host.

#### Refreshing rules

Use **Refresh rules** to pull a fresh firewall rule list from the host.

Refresh is useful after:

<div class="ui-scroll-area" data-direction="horizontal" data-scroll-padding="4" data-visibility="hover" id="bkmrk-you-changed-firewall"><div class="ui-scroll-area__viewport"><div class="ui-scroll-area__content">- You changed firewall rules outside ServersCTL.
- A backup or restore changed host security files.
- The rules table is empty or stale.
- You want to confirm the current live state before editing.

</div></div></div>The rules table updates after the job completes. Check **Cron &amp; Jobs** if the refresh does not appear to finish.

### Managing the firewall

Use **Firewall** to enable or disable the detected firewall backend.

Before enabling the firewall:

<div class="ui-scroll-area" data-direction="horizontal" data-scroll-padding="4" data-visibility="hover" id="bkmrk-make-sure-ssh-is-all"><div class="ui-scroll-area__viewport"><div class="ui-scroll-area__content">- Make sure SSH is allowed from your access IP or management network.
- Make sure required web, database, control panel, and monitoring ports are allowed.
- Refresh the rule list so you can see what will apply.

</div></div></div>Before disabling the firewall:

<div class="ui-scroll-area" data-direction="horizontal" data-scroll-padding="4" data-visibility="hover" id="bkmrk-understand-that-inbo"><div class="ui-scroll-area__viewport"><div class="ui-scroll-area__content">- Understand that inbound filtering is reduced or stopped until it is enabled again.
- Use this only for controlled troubleshooting or planned maintenance.

</div></div></div>Existing rules are preserved. Refresh rules after the job completes so the table reflects the new state.

#### Adding rules

Use **Add rule** to allow, deny, or reject traffic by protocol, port, and source.

The form asks for:

<div class="ui-scroll-area" data-direction="horizontal" data-scroll-padding="4" data-visibility="hover" id="bkmrk-field-meaning-action"><div class="ui-scroll-area__viewport"><div class="ui-scroll-area__content"><div><div><table><thead><tr><th>Field</th><th>Meaning</th></tr></thead><tbody><tr><td>**Action**</td><td>Allow, deny, or reject matching traffic.</td></tr><tr><td>**Protocol**</td><td>TCP or UDP.</td></tr><tr><td>**Port**</td><td>A single port or a valid range.</td></tr><tr><td>**Source**</td><td>`any` or an IPv4 CIDR range.</td></tr><tr><td>**Comment**</td><td>Optional note to make the rule easier to identify later.</td></tr></tbody></table>

</div></div></div></div></div>Use narrow sources where possible. For example, allow SSH from your office or VPN range instead of allowing it from anywhere.

#### Deleting rules

Use **Delete** from the firewall rules table when a rule is no longer needed.

Deleting a rule can immediately change live traffic. Check the action, port, protocol, source, and comment before confirming.

#### SSH access

Use **SSH access** to enable or disable the SSH service on the host.

Disabling SSH may close current sessions and block new SSH logins. The balctl agent should continue running, so you can turn SSH back on from the Security tab when the member is still checking in.

Use this carefully. If the agent stops checking in and SSH is disabled, you may need console access from your server provider.

#### Firewall backup

Use **Firewall backup** before large firewall changes, migrations, or security cleanups.

Firewall backups are stored with the member's backups so they can be found from the backup and restore areas. Keep a backup before removing broad rules or changing access to production services.

#### What this tab does not manage

The Security tab is host-level only.

<div class="ui-scroll-area" data-direction="horizontal" data-scroll-padding="4" data-visibility="hover" id="bkmrk-section-content-fire"><div class="ui-scroll-area__viewport"><div class="ui-scroll-area__content"><div><div><table><thead><tr><th>Not managed here</th><th>Where to manage it</th></tr></thead><tbody><tr><td>cPanel users, packages, and account access</td><td>cPanel tab or WHM</td></tr><tr><td>AutoSSL and website certificates</td><td>cPanel or OpenLiteSpeed tools, depending on the server</td></tr><tr><td>Database users and grants</td><td>MariaDB / MySQL tab or database tools</td></tr><tr><td>DNS provider security</td><td>Managed DNS or provider settings</td></tr></tbody></table>

</div></div></div></div></div>