Secure by Design
We prioritize the security of your servers and data above all else. Here is how we protect your infrastructure.
No SSH credentials
WolfPanel never receives your SSH credentials. You run a one-line installer with a single-use, short-lived token that we store only as a hash.
Encrypted, outbound connection
The agent connects out to the panel over TLS 1.2+ and adds no listening port to your server.
Whitelisted actions only
The agent runs only a whitelisted set of actions you trigger from the panel. The site terminal runs as a non-root user; the root terminal is off by default.
Separated accounts & scoped access
Accounts and servers are kept apart. Team members can be limited to specific servers, sites, and command categories.
Renewals & signed updates
Let's Encrypt certificates renew automatically. Agent updates are one click from the panel, and every release is signed.
Audit logs
Commands run on your servers and changes to your account are recorded with a timestamp.
Infrastructure & Controls
- Hosted in the EU (Hetzner, Germany)
- UFW firewall, fail2ban, and trusted IPs
- SSH users, keys, and login policy
- WAF (ModSecurity CRS) and security advisor
- Schedulable daily or weekly site backups
- Cloudflare DNS tokens and chosen mailbox passwords encrypted at rest
Vulnerability Disclosure
If you have discovered a vulnerability, please report it to us privately before disclosing it. We take every report seriously.