The Security section in Cloudways Velocity Application helps you keep your app safe.
An incident is suspicious activity that the security system has detected, such as a harmful request from an unknown visitor.
Malware is harmful code or a file designed to damage your application or steal information.
In this article, you will learn how to view security incidents, allow or block an IP address from an incident, and turn on Malware Protection for your application.
How to View Security Incidents and Enable Malware Protection on your Cloudways Velocity Application
To visit Security on Cloudways Velocity Application in order to see all security incidents and enable malware protection, you need to following the below mentioned navigational steps.
Navigate to: Velocity → My Applications → Select Application → Security as shown in the images below.
View Incidents
Click on the Incidents tabs as shown below.
The Incidents tab allows you to view the list of all incidents across your application.
An incident is a detected event on the application that qualifies as suspicious activity.
These incidents are updated every 60 seconds.
Enable Malware Protection
Open Security → Malware Protection.
Malware Protection scans your application for harmful code and helps clean detected threats. It is powered by Imunify360 and provides automated scanning and cleanup features.
The page shows whether Malware Protection is currently active. When it is available with your Velocity plan but not enabled, select Enable Protection.
Enable Protection
Review the displayed protection information.
Select Enable Protection.
Wait for activation to complete.
Return to the page and confirm that protection is active.
The protection shown in the Platform may include:
Phishing Protection
Helps detect and block harmful pages or code designed to steal passwords or other private information.
System Protection
Helps protect the application environment from harmful activity.
Database Protection
Checks for harmful content inserted into the application database and cleans supported threats.
Malware Cleanup
Automatically cleans supported infected files after malware is detected.
Proactive Defense
Checks application activity while it runs and blocks supported malware actions before they complete.
Other Protection
Provides additional protection against supported online attacks and suspicious activity.
Malware Protection uses real-time and scheduled scanning, detection, and automated cleanup to protect supported applications.
Note:
Malware Protection is displayed as included in the plan in the current Velocity interface. Availability may depend on your active Velocity plan and application status.
Recommended Security Practices
Review the Overview and Incidents pages regularly, especially after unusual traffic or a application error.
Allow an IP address only after confirming that it belongs to a trusted user or service.
Use temporary TTL values when access is needed only for a limited period.
Avoid blocking an entire country when blocking a specific harmful IP address is sufficient.
Enable Malware Protection when it is available but inactive.
Keep application dependencies and packages current. Security tools can block many threats, but they cannot correct unsafe or outdated application code.
Review security alerts together with the application access, error, and runtime logs before making major changes.
Maintain current backups so the application can be restored if files or data are damaged.
Frequently Asked Questions
Does a security incident mean that my application was compromised?
No. An incident means that suspicious activity was detected. The security system may have blocked the request before it affected the application.
What is the difference between allowing and blocking an IP?
Allowing an IP permits its requests to reach the application. Blocking an IP prevents its requests from reaching the application.
Should I block every IP shown in the Incidents section?
No. Some incidents may be caused by automated scans, shared networks, trusted services, or incorrectly identified requests. Review the event before blocking the IP.
What happens when a firewall TTL expires?
A rule with a TTL is removed automatically when the selected time ends.
Can I block several countries at the same time?
Yes. The country rule allows you to select more than one country before applying the block.
What should I do when my domain is reported as unsafe?
Review your Malware Protection results and server/application logs, remove harmful content, change exposed credentials, and inspect recent server/application changes. You may also need to request another review from the service that reported the domain.
Does Malware Protection replace server/application security practices?
No. Continue using strong passwords, secure authentication, restricted access, safe server/application code, current dependencies, and regular backups.
What should I do if trusted users cannot access the server/application?
Check the Incidents and Firewall sections to confirm that their IP address or country was not blocked. Remove or update the incorrect rule after confirming that the access is legitimate.
That's it! We hope this article was helpful.