Website security is built on several layers of protection rather than a single tool. On SVAI servers, we use antivirus scanning, a web application firewall, our own bot activity analysis system, and automated backups. Below, we briefly explain how these mechanisms work, what may be blocked, and what actions you can perform yourself in DirectAdmin.
1. ImunifyAV antivirus scanning
To monitor account files, we use the antivirus system ImunifyAV. Files hosted on our servers are regularly scanned for malicious code, web shells, infected PHP scripts, and other potential threats.
If the system detects suspicious or infected files, a corresponding notification is sent to the client's account.
DirectAdmin → Extra Features → ImunifyAV Plugin2. Website protection with ModSecurity
SVAI web servers use ModSecurity, a web application firewall (WAF) that analyzes HTTP requests and can block potentially dangerous traffic before it is processed by the website or CMS.
The protection is based on the Comodo WAF ruleset, supplemented by SVAI's own security rules. These are used to counter common attack patterns, aggressive scanning, and automated vulnerability discovery.
- aggressive automated website scanning;
- large-scale probing for known vulnerabilities;
- abnormal bot activity;
- large numbers of suspicious or invalid requests;
- dangerous POST requests associated with current vulnerabilities in popular CMS platforms;
- automated attempts to compromise websites.
Known search engines and legitimate crawlers are handled separately and added to allowlists, so normal website indexing by search engines should not be blocked by our additional rules.
DirectAdmin → Advanced Features → Web Application FirewallAudit log and rule management
In the Web Application Firewall section, an audit log is available for each domain. It allows you to review ModSecurity events and determine which specific rule blocked a request.
The rule management section also allows you to exclude an individual rule for a specific domain, either temporarily or permanently.
False positives
Any automated security system may occasionally classify a legitimate request as dangerous. Such events are known as false positives.
This may happen when using non-standard CMS components, APIs, synchronization software, data import tools, automated services, or other software with unusual request patterns.
If a rule was disabled because of excessive bot activity or resource usage, we recommend monitoring your account's resource consumption in the Resource Usage section and keeping the limits of your hosting plan in mind.
3. Bot activity monitoring with BotDetector
In addition to standard security mechanisms, SVAI servers use our own tools for analyzing web server access logs.
The system analyzes the behavior of visitors and automated clients, including request frequency and sequence, access patterns, the number of invalid requests, repeated activity, and other behavioral characteristics.
Our own data analysis models are also used to identify suspicious activity. They help distinguish normal visitors and legitimate search engine crawlers from automated systems performing large-scale website scanning or vulnerability discovery.
DirectAdmin → Extra Features → BotDetectorSome clearly malicious activity may be blocked automatically. Blocking is performed at the ModSecurity level, so in the event of a false positive, you can review the event in the audit log and exclude the corresponding rule if necessary.
If a legitimate service or a bot you rely on is blocked incorrectly, please contact technical support. This helps us improve the rules and reduce the number of false positives.
4. Keep your CMS, plugins, and components up to date
Server-side protection significantly reduces risk, but it cannot fully compensate for outdated or vulnerable software.
We recommend paying particular attention to popular CMS platforms such as WordPress and Joomla, as well as their installed plugins, modules, components, and themes.
- update your CMS to the latest stable version;
- update plugins, themes, and components;
- remove extensions that are no longer used;
- avoid components that are no longer maintained by their developers;
- do not leave old or test copies of websites publicly accessible.
Modern automated code analysis tools and artificial intelligence models are accelerating the discovery of potential vulnerabilities. At the same time, tools used for large-scale discovery of vulnerable websites are becoming increasingly automated.
5. Automated backups
Another important layer of protection is the ability to restore data quickly after accidental file deletion, an unsuccessful CMS update, website damage, or a security compromise.
SVAI hosting includes an automated incremental backup system for website files and databases.
DirectAdmin → Extra Features → Borg BackupIn this section, you can view available restore points and restore the required files or databases yourself.
What you should keep in mind
Website security is a shared responsibility between the hosting provider and the website owner. On our side, server-level protection, monitoring, and backup mechanisms are in place. On the website owner's side, it remains especially important to keep the CMS, plugins, and other software up to date.
If you have questions about ModSecurity events, files detected by the antivirus system, bot activity, disabling a specific rule, or restoring a backup, please contact our technical support team for additional assistance.