Security
Panel Security
Section titled “Panel Security”ALTCHA (PoW Anti-Brute-Force)
Section titled “ALTCHA (PoW Anti-Brute-Force)”The login page uses ALTCHA Proof-of-Work, requiring clients to solve a computational challenge before submitting login requests.
Two-Factor Authentication (2FA)
Section titled “Two-Factor Authentication (2FA)”TOTP-based 2FA support — enable in Settings → Security, scan QR code with Google Authenticator / Authy.
JWT Authentication
Section titled “JWT Authentication”All API requests use JWT tokens with persistent key storage (survives restarts).
Audit Logging
Section titled “Audit Logging”All write operations (POST/PUT/DELETE) are automatically logged with timestamp, user, path, and response status.
Security Headers
Section titled “Security Headers”Automatic security headers: X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy.
Login Failure Alerts
Section titled “Login Failure Alerts”After 5 consecutive failures, webhook/email notifications are sent (10-minute throttle).
Site Security
Section titled “Site Security”per-site disable_functions
Section titled “per-site disable_functions”Disable dangerous PHP functions per site using php_admin_value (cannot be overridden in .htaccess).
.htaccess Security
Section titled “.htaccess Security”LiteHttpd fully supports .htaccess. WordPress installations automatically get wp-config.php protection, upload directory PHP execution blocking, and xmlrpc.php blocking.
RBAC (Role-Based Access Control)
Section titled “RBAC (Role-Based Access Control)”LLStack supports multi-user access with four roles:
| Role | Description |
|---|---|
| Owner | Full panel access, manages users and plans |
| Admin | Manages all sites, databases, and services |
| Developer | Manages assigned sites only, no system settings |
| Viewer | Read-only access to assigned sites |
Site-Level Permissions
Section titled “Site-Level Permissions”Admins can assign specific sites to Developer and Viewer users, restricting access to only their designated sites.
Plan Quotas
Section titled “Plan Quotas”Each user can be assigned a plan with resource limits:
| Quota | Description |
|---|---|
max_sites | Maximum number of sites the user can create |
max_databases | Maximum number of databases the user can create |
disk_quota | Maximum disk usage allowed (in MB) |
File Manager Security
Section titled “File Manager Security”The built-in file manager is restricted to site document root directories only. Symlink escape protection is enforced to prevent directory traversal outside the allowed paths.
File Permissions
Section titled “File Permissions”The panel follows least-privilege principles: SSL keys at 0600, site files owned by system user (not root), operations via sudo-restricted shell scripts.