Recent Posts
1
CentOS-WebPanel Bugs / Re: Google Recapcha not work on all CWP servers.
« Last post by comokoko on Today at 12:47:00 PM »The fact that this issue occurs across hundreds of different sites (each using different PHP scripts) on dozens of CWP servers indicates that the problem originates from CWP. This issue did not exist prior to AlmaLinux 9 and the current version of CWP.
2
Aplications / Re: Abnormal fevicon and title in google results
« Last post by anandmys on Today at 07:39:14 AM »PM me server details if you want me to take a look.
Have sent you details
3
Backup / Re: NEW Backup: Still in Perpetual Beta? Critical Issues Unresolved for Months (CWP7
« Last post by cyberspace on October 11, 2026, 09:43:14 PM »CWP offers Secure Kernel feature (not free):
https://wiki.centos-webpanel.com/cwp-secure-centos-kernel
Secure kernel is based on Tomoyo:
https://en.wikipedia.org/wiki/Tomoyo_Linux
and provides MAC (mandatory access control) like SELinux.
It is quick answer on: Isolation of account files and processes are weak, relying only in file permissions.
Additionally, according to:
https://centos-webpanel.com/how-to-install-cloudlinux
CWP supports CloudLinux. So I suppose it should support cagefs. However I haven't tested CloudLinux with CWP.
https://wiki.centos-webpanel.com/cwp-secure-centos-kernel
Secure kernel is based on Tomoyo:
https://en.wikipedia.org/wiki/Tomoyo_Linux
and provides MAC (mandatory access control) like SELinux.
It is quick answer on: Isolation of account files and processes are weak, relying only in file permissions.
Additionally, according to:
https://centos-webpanel.com/how-to-install-cloudlinux
CWP supports CloudLinux. So I suppose it should support cagefs. However I haven't tested CloudLinux with CWP.
4
Backup / Re: NEW Backup: Still in Perpetual Beta? Critical Issues Unresolved for Months (CWP7
« Last post by adrianofnatal on October 11, 2026, 08:25:05 PM »Im PRO user too, for YEARS.
I quit from CWP panels, today, I have only one server.
One of the reasons was backup malfunction.
Other was:
- Isolation of account files and processes are weak, relying only in file permissions.
- NodeJS apps difficult to read error logs (they aren't integrated in panel and dont show app ID to get log from console)
- Proxy template does not work. You can create a proxy template and set to domain but in next reload, panel does not use your template.
- OWASP modsecurity rules does rename initialization file, causing the rules to be not applyed (just warnings showed). If you rename manualy, it works, but in next update, your rename is lost.
- Customer panel with a log of bugs, including not show Postgresql databases.
- Postgres databases are not backuped.
- NodeJS apps was not recreated after backup restore.
- Migration from CWP to CWP does not work with SSH private keys.
- We have problems with invasion of our servers. Suspect that was entering throug API port 2304.
- Some file editors save files with errors.
This was what I found.
It could be a good, promising panel, but I don't know what goes on behind the scenes.
In the meantime, as hosting managers, we can't rely on it.
I quit from CWP panels, today, I have only one server.
One of the reasons was backup malfunction.
Other was:
- Isolation of account files and processes are weak, relying only in file permissions.
- NodeJS apps difficult to read error logs (they aren't integrated in panel and dont show app ID to get log from console)
- Proxy template does not work. You can create a proxy template and set to domain but in next reload, panel does not use your template.
- OWASP modsecurity rules does rename initialization file, causing the rules to be not applyed (just warnings showed). If you rename manualy, it works, but in next update, your rename is lost.
- Customer panel with a log of bugs, including not show Postgresql databases.
- Postgres databases are not backuped.
- NodeJS apps was not recreated after backup restore.
- Migration from CWP to CWP does not work with SSH private keys.
- We have problems with invasion of our servers. Suspect that was entering throug API port 2304.
- Some file editors save files with errors.
This was what I found.
It could be a good, promising panel, but I don't know what goes on behind the scenes.
In the meantime, as hosting managers, we can't rely on it.
5
CentOS-WebPanel Bugs / Re: Google Recapcha not work on all CWP servers.
« Last post by Starburst on October 11, 2026, 07:18:16 PM »Website owners use Google reCAPTCHA for site registrations, member logins, form submissions, and the like.
In other words, reCAPTCHA is not used for CWP panel logins or similar access points.
So if I read that right, then this isn't a CWP 'bug' since it isn't being used for CWP logins or other access.
It's being used by sites, and hence their coding.
6
Backup / Re: NEW Backup (beta) / Restore Account -> Does not list accounts to restore
« Last post by adrianofnatal on October 11, 2026, 04:09:28 PM »S3 Backup never worked.
It fails to upload in scheduled backup.
Sometimes a manual backup works. In a second try, does not work anymore.
I didnm' use it anymore.
I generate a local backup (which works well unless you not using PostgreSQL because does not backup databases) and got a script to upload backups to somewhere.
Backup is a VERY IMPORTANT, if not the MOST IMPORTANT thing in a server.
After version 0.9.xx this new backup never worked.
It fails to upload in scheduled backup.
Sometimes a manual backup works. In a second try, does not work anymore.
I didnm' use it anymore.
I generate a local backup (which works well unless you not using PostgreSQL because does not backup databases) and got a script to upload backups to somewhere.
Backup is a VERY IMPORTANT, if not the MOST IMPORTANT thing in a server.
After version 0.9.xx this new backup never worked.
7
Aplications / Re: Abnormal fevicon and title in google results
« Last post by overseer on October 11, 2026, 02:27:29 PM »PM me server details if you want me to take a look.
8
Aplications / Re: Abnormal fevicon and title in google results
« Last post by kadybee on October 11, 2026, 12:31:07 PM »This hack has been around a while and mentioned in a number of threads here, search for mod_auth_form.so
There is a fake version that gets loaded and causes the likes of 'googlebot' to get a different page than other browsers.
In the first instance comment out (or remove) the loading of that module in your apache/conf/http.conf;
remove the file from the modules directory and then work on all the other security suggestions in threads here to clean up and lock them out.
There is a fake version that gets loaded and causes the likes of 'googlebot' to get a different page than other browsers.
In the first instance comment out (or remove) the loading of that module in your apache/conf/http.conf;
remove the file from the modules directory and then work on all the other security suggestions in threads here to clean up and lock them out.
9
Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection
« Last post by anandmys on October 11, 2026, 12:09:14 PM »Any step by step guide to check the infection and clean? Looks like atleast 1 of my installation is infected
10
Aplications / Abnormal fevicon and title in google results
« Last post by anandmys on October 11, 2026, 11:46:45 AM »I am using cwp to host this website https://mysorecabs.com
If you search site:mysorecabs.com in Google, you see the icon and title (SPAM) 100% different from what you see in view source or browser
I saw this in few more websites on the same server.
Looks like something hacked at server level.
Please help
If you search site:mysorecabs.com in Google, you see the icon and title (SPAM) 100% different from what you see in view source or browser
I saw this in few more websites on the same server.
Looks like something hacked at server level.
Please help
