Native WHM / cPanel protection AI correlation · Local evidence · No mandatory cloud
YOORguard
EN
30-day free trial
Operational sovereignty for cPanel hosting
YOORguardAI security corecPanelcPanel SecurityWHM

YOORguard at the heart of cPanel.
Security decides on evidence.

Institutional-grade server defence where AI correlates traffic, identities, services and files in real time. YOORguard then requires local evidence before challenging, blocking or restoring.

Explore protection View the interface
✓ Observation mode ✓ Governed enforcement ✓ IPv4 + IPv6
WHM / cPanelNative integration
AI + localContextual correlation
171Built-in checks
nftablesDedicated firewall
0Mandatory cloud
Security built for hosting

YOORguard is the security core of cPanel.

YOORguard places its defence chain beside EasyApache4, WHM and every cPanel account. Administrators govern the server; each customer receives a compartmentalised view of their own attack surface.

01

Account-scoped data

No cross-account leakage: customers only see their domains, events and quarantine.

02

Threats made understandable

Seven-day view, attacker geolocation and rDNS, plus a clear block history.

03

Accessible quarantine

Suspicious files stay visible and traceable from the customer area.

YOORguard
cPanel
Account protectionclient.example
Active
ScopeThis account only
Activity · 7 days−34%
Latest qualified eventWebshell attempt stoppedHTTP · 21:15:10
A verifiable decision chain

Observe. Correlate with AI. Qualify. Protect.

YOORguard never confuses unusual activity with a proven threat. AI puts signals into context; every automated action then passes through a local qualification gate.

Observe. Correlate with AI. Qualify. Protect.
Fundamental rule No firewall write without evidence.

AI contextualises and recommends; it never writes to the firewall by itself. Qualified local evidence and trust guardrails remain mandatory.

Observe

Traffic, logs, services, files and Apache pressure are analysed continuously.

Web behaviour Identity & services Files & malware Network & reputation

Correlate with AI

The engine connects timing, target, identity, service, behaviour and recurrence to reveal coherent attack scenarios.

Temporal, behavioural and cross-service correlation

Qualify

Score, local hostility, global IP checks, exclusions and probation establish the evidence.

Qualified scenario Explainable score · factors · scope · recurrence

Protect

Challenge, nftables block or quarantine: every action stays proportional and traceable.

Local evidence gate No firewall write without evidence.
Governed artificial intelligence

AI connects the signals. Local evidence keeps the final say.

The correlation engine turns isolated events into understandable attack scenarios. It prioritises risk, explains the factors retained and hands the decision to a deterministic local gate.

Never an autonomous block based on model intuition alone.
AI connects the signals. Local evidence keeps the final say.
YOORguard AI Contextual AI engine

Temporal, behavioural and cross-service correlation

Qualified scenario

Explainable score · factors · scope · recurrence

Local evidence gate

Exclusions, trust, challenge and proportionality before any action

Web behaviour Identity & services Files & malware Network & reputation
Complete server protection

From first signal to remediation.

A local engine covers web, services, network and files, operated natively through WHM and cPanel.

Dedicated nftables, IPv4 + IPv6
Firewall

Dedicated nftables, IPv4 + IPv6

An isolated YOORguard table, six escalating TTL levels and synchronisation only in Live mode.

Challenge first, block second
Web security

Challenge first, block second

Ambiguous traffic receives a signed, IP-bound verification. Repeated bypass attempts trigger escalation.

Brute force stopped on local proof
Services

Brute force stopped on local proof

FTP, SMTP, SSH, mail, cPanel and MySQL are correlated without waiting for an external source.

Detection and quarantine
Files

Detection and quarantine

A multi-rule engine, ClamAV and external adapters connect a compromised file to its network source.

Controlled ports and geo-blocking
Exposure

Controlled ports and geo-blocking

Approved ports in one place and 249 countries available, off by default with protected trust exemptions.

Signed self-protection
Integrity

Signed self-protection

SHA-256 vault, continuous self-healing and a version-pinned enforcement token.

Multi-surface detection engine

Threats are correlated, not merely counted.

YOORguard’s AI engine brings together web, network, authentication and file events to separate noise from an actionable attack. Evidence remains local, contextual and reversible.

Web exploitation

Hostile signatures and application context

Detection focused on attacks that truly target hosted applications, while controlling WordPress core false positives.

  • Webshells, path traversal and backdoor names
  • Installer takeovers and fake file managers
  • Exploited PrestaShop modules and deployment artefacts
  • Hostile headers, probes and sensitive paths
L7 volumetry

Distributed and concentrated floods by domain

Sliding windows separate legitimate growth from aggressive campaigns without treating Apache load as standalone evidence.

  • Concentrated and distributed analysis per domain
  • Apache pressure used as a contextual accelerator
  • Correlation with already-proven hostility
  • Challenge before blocking ambiguous traffic
Identity & services

Cross-service brute force and credential spray

Authentication bursts and protocol probes are correlated across FTP, SMTP, SSH, mail, MySQL and cPanel.

  • Failure bursts and credential spraying
  • Hostile correlation across several services
  • Direct blocking once local evidence is acquired
  • Progressive TTL based on severity and recurrence
Malware & files

The file, its nature and its network source

A native multi-rule engine combines ClamAV and external adapters to connect compromised artefacts to attackers.

  • Named webshell matched against a real file
  • Scan, quarantine and source-IP blocking
  • Injected-file versus modified-original distinction
  • Recovery only from a known-clean backup
06

Guardrails that make automation defensible

Intelligent mail scanning

Qualification adapted to legitimate messaging flows.

Local address reputation

Known-good addresses are reconciled automatically.

Advisory intelligence

External feeds corroborate; they never trigger a block alone.

Protected payments and webhooks

Static exemptions and poison-resistant dynamic learning.

249 governable countries

Geo-blocking is off by default and trusted networks remain untouchable.

Explicit network surface

Approved ports are centralised and audited in WHM.

Native WHM interface

Readable security, without leaving WHM.

Activity, decisions, web protection, health and network exposure come together in an interface made for server administrators.

Incidents, attacks, local signals and action-ready decisions.Enlarge screenshot ↗
Security dashboard

Incidents, attacks, local signals and action-ready decisions.
Correlated incidents, security lists, firewall and IP reputation.Enlarge screenshot ↗
Protection Center

Correlated incidents, security lists, firewall and IP reputation.
Visitor challenge, attack intelligence, domains and file defence.Enlarge screenshot ↗
Web Security

Visitor challenge, attack intelligence, domains and file defence.
Heartbeat, sources, backlog, load and Apache pressure in real time.Enlarge screenshot ↗
Monitoring & Health

Heartbeat, sources, backlog, load and Apache pressure in real time.
Exposed port management and country blocking on one screen.Enlarge screenshot ↗
Firewall configuration

Exposed port management and country blocking on one screen.
Evidence-led remediation

Clean up without restoring the compromise.

YOORguard distinguishes an injected file from a modified legitimate file, then chooses a safe action using available backups.

↺Recovery connected to your backupsJetBackup · YOORbackup
01

Injected file

A webshell absent from the legitimate application is removed or quarantined.

→Quarantine
02

Modified original

A clean version strictly older than the infection is restored through JetBackup or YOORbackup.

→Clean restore
03

No clean version

The case is reported. YOORguard never restores a questionable backup at random.

→Report
Autonomous by design

On the server. Under your control.

YOORguard runs as a Python daemon supervised by systemd, on the standard EasyApache4/cPanel stack and with no mandatory cloud dependency.

PythonAutonomous daemon
systemdHardened service
cPanelEasyApache4
0Cloud required
Frequently asked questions

Understanding YOORguard.

01Is YOORguard really integrated with cPanel?

Yes. Administrators control security from WHM and every customer gets a cPanel view strictly scoped to their account, including activity, attackers and quarantine.

02Can an address be blocked on external reputation alone?

No. Threat intelligence feeds remain advisory. An automatic firewall write requires hostile evidence observed locally.

03What is the difference between Observation and Enforce?

Observation analyses and decides without writing to the firewall. Enforce applies qualified decisions to nftables with a version-bound approval token.

04How does YOORguard avoid blocking legitimate visitors?

Ambiguous web traffic receives a signed challenge first. Trusted networks, server addresses, allow lists, payments and webhooks benefit from protected exemptions.

05What happens when a file is compromised?

An injected file is quarantined. A modified original can be restored from an older clean backup. With no safe version, YOORguard reports instead of taking a risk.

06What role does artificial intelligence play in YOORguard?

AI correlates and contextualises signals from web, network, identities, services and files. It produces an explainable scenario, while action remains subject to local evidence and deterministic guardrails.

Documentation

Install YOORguard step by step.

One command installs YOORguard in observation mode: nothing is blocked and your current protections stay in place. The switchover then happens step by step, with checks and a rollback at every step.

Requirements

  • cPanel & WHM server (Jupiter theme), root SSH access.
  • AlmaLinux or CloudLinux 8 or 9, with systemd.
  • Python 3.9 or later (python3), shipped with cPanel servers.
  • Apache (EasyApache 4) with nginx in front, required for the browser challenge and traffic limiting: AUTOM8N (Nginx cPanel plugin) if it is already installed, otherwise the cPanel nginx (ea-nginx); other nginx plugins will be supported soon.

Imunify360, CSF and ModSecurity may stay installed: they are detected and taken over during migration.

Installation

As root, download and run the installer:

curl -fsSL -o install.sh \
  https://repo.yoorshop.net/maj/yoorguard-cpanel/install.sh
bash install.sh

The installer identifies the server, activates the trial licence, downloads the package, checks its sha256 fingerprint and installs. Each step shows ok or the cause of failure; the log is written to /root/yoorguard/logs/.

Progressive rollout

  1. 1
    Observation (shadow)

    Right after installation, YOORguard analyses the server and traffic without blocking anything. Open WHM › Plugins › YOORguard.

  2. 2
    Step 1: firewall

    The Migration tab lists the detected software. Imunify360 or CSF lists and ports are taken over; each red check explains how to fix it and the switchover waits for your confirmation.

  3. 3
    Step 2: ModSecurity

    Offered only after step 1 is confirmed. Every step keeps its before/after proofs and can be rolled back.

  4. 4
    After going live: restoration

    In Backup recovery, choose JetBackup 5 or YOORbackup as the source. An infected file can then be restored from the last clean backup of the cPanel account concerned.

Update

yoorguard-update

A single command as root. The package is checked by sha256 before it is applied.

Uninstall

Uninstalling restores the original configuration. YOORguard files are moved to /root/yoorguard/backup/, never deleted.

Trial licence

30-day trial activated automatically at installation, no credit card. The licence is bound to the server identifier.

A question about installation? Contact our team ↗

Straightforward licensing

30 days to prove YOORguard. €99 to protect your server for a full year.

Deploy YOORguard in your own WHM and cPanel environment, evaluate the complete defence chain for 30 days, then retain the same protection with one simple annual licence.

30days included
Full-feature trial

Every YOORguard capability is available on your real infrastructure throughout the evaluation period.

✓ No payment card required
YOORguardAnnual licence
99€excl. VAT / year / server

One clear, predictable price to keep YOORguard protection active on one server for twelve months.

  • Native WHM and cPanel integration
  • AI correlation and local evidence
  • Observation and Enforce modes
  • IPv4 and IPv6 protection
Start the 30-day trial ↗ Discuss deployment
Guided activation through YOORhosting.
Plans & partners

Protect, host and run your business.

Three YOORhosting NVMe SSD infrastructures to deploy YOORguard, followed by two selected partners that simplify business operations.

YOORhosting infrastructureNVMe SSD · Europe & Canada
Web hosting

Web NVMe SSD

A fast, manageable cPanel foundation for websites, blogs and shops.

From€7.95ex. VAT / month
  • Complete cPanel administration
  • Free SSL and HTTP/2
  • External daily backups
  • Expert support 24/7/365
Discover the plan ↗
Cloud hostingYOORhosting

Cloud NVMe SSD

More power and resilience for demanding projects.

From€11.95ex. VAT / month
  • Flexible, scalable architecture
  • High availability
  • Premium connectivity
  • Expert support 24/7/365
Discover the plan ↗
VPS hosting

VPS NVMe SSD

Full server control for a security configuration tailored to your needs.

From€7.95ex. VAT / month
  • Full administrator access
  • NVMe SSD performance
  • Configuration adapted to your load
  • Expert support included
Discover the plan ↗
100% NVMe SSD24/7/365 support99.95% SLADaily backups
Business partners

A better-organised business around your infrastructure.

YOOR referral links. Terms, pricing and availability remain those of each partner.

QontoBusiness account

The business account designed for freelancers and companies.

Bring payments, cards, expenses and receipts together in one clear web and mobile interface.

  • Online opening and management
  • Expense tracking tools
  • Accounting exports and integrations
Discover Qonto ↗
DougsOnline accounting

Your accounts, invoices and deadlines in one place.

Track your business and work with a chartered-accounting team from one interface.

  • Management dashboard
  • Accounts and declarations
  • Dedicated guidance
Discover Dougs ↗
A different way to secure cPanel hosting

Local evidence before action.

Discover autonomous server protection that is clear in WHM and useful inside every customer’s cPanel space.

Discuss deployment ↗ Review the interface