Sentinel · cPanel/WHM security audit
Let us find the weaknesses on your cPanel server before anyone else does
Sentinel regularly audits your cPanel/WHM server across 17 modules, including SSH, firewall, PHP, MySQL, SSL and kernel settings. Every finding is reported in Turkish, along with why it matters and how to fix it. You approve each fix; Sentinel takes a backup first, then makes the change, then checks again.
- 17 audit modules, about 47 individual checks
- Nothing changes on your server without your approval
- Turkish PDF report and email summary
Why do cPanel servers quietly weaken?
A server is usually in good shape on the day it is set up. Problems build up over months: updates get postponed, certificates expire unnoticed, a debug setting is left on. None of this stops the site from loading, so nobody notices.
Patches lag behind
When critical security updates are released for cPanel, PHP and the kernel, it is hard to track by hand whether the server is actually running the patched version. On every audit, Sentinel compares the running version against known vulnerabilities.
Certificates expire unnoticed
On a server hosting hundreds of sites, certificates that AutoSSL failed to renew come to light through a visitor's browser warning. Sentinel lists expired certificates and those expiring within 30 days.
Doors are left open
Root login with a password, a MySQL or Redis port exposed to the internet, cPHulk left disabled… Each setting may look minor on its own, but each one opens the door to brute-force attacks.
Nobody asks for a report, until something goes wrong
When you need to show a customer or manager that the server is secure, having a dated, easy-to-read report makes the job much easier.
How does it work?
Four steps from purchase to your first report. You do not need to install any software on the server; Sentinel connects over SSH.
1. Choose a plan, your account is created
When you buy a plan on teknoweb.net, your Sentinel account is created automatically as soon as payment is confirmed, and you receive an email to set your password. Your invoices are in the teknoweb.net customer panel.
2. Connect your server
In the panel, you enter the server address and SSH access (root or a user with sudo rights; password or private key). Sentinel shows the server's SSH key fingerprint and you confirm it. If the fingerprint changes later, Sentinel stops connecting and does not send the credentials.
3. The audit runs
Once you confirm the connection, you start the first audit with one click; results are ready within a few minutes. After that, automatic audits run on the 1st of every month on the Essential plan, and additionally every Monday on the Professional plan. You can start a manual audit from the panel at any time.
4. Read the report, fix with approval
The security score, findings ordered by severity and the Turkish PDF report are ready in the panel; critical findings arrive by email. Before fixing a module, you can use "Show first" to see which commands will run, then fix it with one click.
17 audit modules
Each module checks a specific risk. Issues that can be fixed automatically are fixed with your approval; settings that could break sites are only reported as recommendations.
Kernel vulnerability (CVE-2026-31431)
Whether the running Linux kernel includes the "CopyFail" privilege escalation patch released for your distribution.
Partially fixedcPanel CRLF vulnerability (CVE-2026-41940)
Whether the installed cPanel version is affected by this injection vulnerability.
Reported onlyPHP remote code execution (CVE-2026-109618)
Every ea-php and alt-php version is checked separately; if unpatched, an update and a temporary mitigation setting can be applied.
Fixed with approvalUpdates
cPanel version and pending operating system security updates.
Fixed with approvalSSH hardening
sshd settings such as password login, root login mode, retry limit and X11 forwarding.
Fixed with approvalFirewall
CSF/LFD, Imunify360 or firewalld status, and whether CSF is still in testing mode. If there is no firewall or firewalld is in use, it also checks whether 16 sensitive ports such as Redis, MongoDB, MySQL and Docker are open to the internet.
Partially fixedcPHulk
Whether the cPHulk service, which protects WHM and cPanel logins against brute force, is enabled.
Fixed with approvalModSecurity
Whether the web application firewall is installed, and whether its rule engine and the OWASP rule set are active.
Partially fixedPHP security settings
expose_php, display_errors and allow_url_include across all EA-PHP versions; risk of settings being overridden under CageFS.
Partially fixedMySQL hardening
Anonymous users, test database, remote root access, authentication method and listen address.
Partially fixedSSL/TLS configuration
Whether AutoSSL is working and the legacy TLS 1.0/1.1 protocols are disabled.
Fixed with approvalFile permissions
World-writable files, the /tmp sticky bit, SUID files that do not match the package database.
Partially fixedWeb server hardening
Apache ServerTokens, ServerSignature, HTTP TRACE; LiteSpeed server header.
Fixed with approvalKernel network settings
6 sysctl settings such as SYN cookies, reverse path filtering, ICMP broadcasts and accepting redirects.
Fixed with approvalSSH keys
An inventory of authorized SSH keys on root and user accounts.
Reported onlyCertificate expiry
Site and cPanel service certificates: expired, and expiring within 7 and 30 days.
Partially fixedReboot required
Pending reboot or service restart after updates. Rebooting is always left to you.
Reported only
Sample report: what do you see after an audit?
The table below is a shortened example of the format you see in the Sentinel panel and the PDF report. The messages are the product's actual finding texts and appear in Turkish, as in the real product (reports are Turkish-only); the server details are illustrative.
| Severity | Module | Finding | Status |
|---|---|---|---|
| Critical | Certificate expiry | 3 sertifika SÜRESİ DOLMUŞ (magaza.ornek.com, eski.ornek.net, …) | Open |
| High | Updates | 4 güvenlik güncellemesi bekliyor | Open |
| High | cPHulk | cPHulkd servisi kapalı — WHM brute-force'a açık | Open |
| High | SSH hardening | PasswordAuthentication = yes (önerilen: no) | Warning |
| Medium | PHP security settings | PHP ea-php82: 1 ayar yanlış: expose_php=On | Warning |
| Medium | Web server hardening | ServerSignature açık — banner yayınlanıyor | Warning |
How is the security score calculated?
Every server starts at 100 points. Each open finding deducts points by severity: critical 30, high 15, medium 6, low 2. Warnings count for half of that value (rounded down). 85 and above is Good, 60 and above is Fair, anything lower is Weak. If you have more than one server, the fleet score on the dashboard is the average of all of them.
The example above: 100 − 30 − 15 − 15 − 7 − 3 − 3 = 27 points, i.e. Weak. Once the expired certificates are renewed and cPHulk is enabled, the score rises to 72 (Fair).
What is in the PDF report?
- Server name, audit time, audit number and the Sentinel version used
- Security score and Good / Fair / Weak band
- Summary table by severity
- All open findings: severity, status, module, message and details
- A "Confidential: for your company only" footer; SSH details never appear in the report
Comparison with the previous audit
Every audit is compared with the previous one: which findings are new, which have been fixed and which are still open. In the critical findings email, newly appeared ones are marked with a "(new)" label.
Fix safety: backup first, then change
A security tool that breaks the server can be a bigger problem than the vulnerability itself. That is why Sentinel's fix flow is designed to be cautious.
No changes without approval
You can keep your server in "report only" mode or exclude specific modules from fixes. A fix always runs module by module and starts with your click.
Show first
Before applying a fix, a dry run shows you which command will touch which file.
Backup and checksum
Every configuration file that changes is first saved as a timestamped copy; a SHA-256 checksum is recorded before and after the change.
Re-check after the change
After a fix is applied, the relevant module runs again; the report shows whether the issue was actually resolved.
Automatic rollback when enabling a firewall
When firewalld is enabled on a server that has no firewall at all, a 300-second safety timer is armed. If the SSH connection and the ports that must stay open cannot be verified, the previous state is restored automatically. On an existing CSF setup, Sentinel only turns off testing mode and allows the SSH port.
Risky settings are not applied automatically
PHP settings that could break sites, such as allow_url_fopen or disable_functions, and server reboots are only reported as recommendations; the decision is yours.
How are your access credentials protected?
Company-specific encryption
The SSH password or key is encrypted with AES-256-GCM using a key separate from the application key. Encrypted data is bound to your company ID; even if copied to another account, it cannot be decrypted.
Not in reports or emails
Credentials, the server key and the SSH user are never written to any PDF, email or API response.
Server identity is pinned
The SSH fingerprint you confirm on first connection is stored. Credentials are never sent to a server that intercepts the connection.
Team and audit trail
Owner, admin and viewer roles; two-factor authentication (TOTP). Who started each audit and fix is recorded.
Data stays in the EU
Sentinel runs in Hetzner's data center in Germany (Falkenstein). Findings and reports are kept only in your company account.
Deleted when the subscription ends
When you terminate your subscription, the remaining data belonging to your account is permanently deleted after 30 days.
Plans and pricing
Prices are per server per month. The unit price drops as the number of servers grows. With annual billing, you pay for 10 months instead of 12.
Essential
For those who want a regular monthly audit and report.
499 ₺ / month
for 1 server
- 17 audit modules
- Automatic audit frequency: Monthly
- Manual audits from the panel
- Security score and Turkish PDF report
- Critical findings email
- Audit history retention: 6 months
- Support: Email, response within 48 hours
Professional
For those who want weekly audits, comparisons and approved fixes from the panel.
899 ₺ / month
for 1 server
- 17 audit modules
- Automatic audit frequency: Weekly
- Manual audits from the panel
- Security score and Turkish PDF report
- Critical findings email
- Comparison with the previous audit
- Approved fixes from the panel
- Audit history retention: 24 months
- Support: Priority, response within 24 hours
Monthly prices by number of servers
| Number of servers | Essential | Professional |
|---|---|---|
| 1 servers | 499 ₺ / month499 ₺ per serverYearly: 4.990 ₺ | 899 ₺ / month899 ₺ per serverYearly: 8.990 ₺ |
| 3 servers | 1.497 ₺ / month499 ₺ per serverYearly: 14.970 ₺ | 2.697 ₺ / month899 ₺ per serverYearly: 26.970 ₺ |
| 5 servers | 2.246 ₺ / month449 ₺ per server · 10% offYearly: 22.455 ₺ | 4.046 ₺ / month809 ₺ per server · 10% offYearly: 40.455 ₺ |
| 10 servers | 3.992 ₺ / month399 ₺ per server · 20% offYearly: 39.920 ₺ | 7.192 ₺ / month719 ₺ per server · 20% offYearly: 71.920 ₺ |
| 25 servers | 8.733 ₺ / month349 ₺ per server · 30% offYearly: 87.325 ₺ | 15.733 ₺ / month629 ₺ per server · 30% offYearly: 157.325 ₺ |
Prices exclude VAT; VAT is added on the invoice. Payment is made via teknoweb.net by credit or debit card; your e-Archive invoice is issued automatically.
When you want to add more servers or move to the Professional plan, you can upgrade from the customer panel; the remaining period is prorated and you only pay the difference.
For more than 25 servers or special requirements, contact us.
Essential vs. Professional
| Feature | Essential | Professional |
|---|---|---|
| 17 audit modules | ✓ | ✓ |
| Automatic audit frequency | Monthly | Weekly |
| Manual audits from the panel | ✓ | ✓ |
| Security score and Turkish PDF report | ✓ | ✓ |
| Critical findings email | ✓ | ✓ |
| Comparison with the previous audit | — | ✓ |
| Approved fixes from the panel | — | ✓ |
| Audit history retention | 6 months | 24 months |
| Support | Email, response within 48 hours | Priority, response within 24 hours |
Who is it for?
Hosting companies and resellers
Regularly audit the cPanel servers that host your customers' sites and show your customers a dated report.
Agencies and software teams
See on a single screen, monthly or weekly, what is missing in the maintenance of the servers you deploy your projects to.
Businesses managing their own server
If you do not have a full-time system administrator, Sentinel explains in plain language what matters and what should be fixed first.
Frequently asked questions
Which servers are supported?
AlmaLinux, Rocky Linux and CloudLinux servers with cPanel/WHM installed. Apache and LiteSpeed are recognized as web servers. Other panels such as Plesk and DirectAdmin are not currently supported.
Do I need to install software or an agent on the server?
No. Sentinel connects to your server over SSH, runs the audit and collects the results. It does not leave a permanently running service on your server.
What access do I need to provide?
SSH access with root or a user with sudo rights; you can use a password or a private key. This level of access is required so the audit can read configuration files and apply the fixes you approve. Access credentials are encrypted with a key specific to your company.
Does Sentinel make changes on my server by itself?
No. The audit only reads. Fixes are always applied module by module with your approval; if you prefer, you can keep the server entirely in "report only" mode.
What happens if a fix breaks something?
Changed files are backed up before every fix, and the module is checked again afterwards. When firewalld is enabled on a server without a firewall, the change is rolled back automatically if SSH and the required ports cannot be verified within 300 seconds. Settings that could break websites are never applied automatically.
How often are audits run?
Automatic audits run on the 1st of every month on the Essential plan, and additionally every Monday on the Professional plan. On both plans, you can start a manual audit from the panel at any time.
Will the audit slow down my server?
The audit consists of short-lived commands that read configuration files and service status, and it is scheduled at night (03:00 UTC). It does not touch your sites' traffic.
Where do I receive notifications?
When an audit finishes, an email is sent with critical findings listed first; you are also notified if an audit fails. All details are in the panel and the PDF report.
How do payment and invoicing work?
Purchasing and invoicing are handled through teknoweb.net. You can pay monthly or yearly; renewals, upgrades and your invoices appear in your teknoweb.net customer panel.
What happens to my data if I cancel my subscription?
When your subscription ends, your account is suspended. The remaining data of terminated accounts is permanently deleted after 30 days.
Do you have certifications or security attestations?
Sentinel is a new product; independent penetration testing and certification processes such as ISO have not been completed yet. That is why we explain openly on this page and in our blog posts what the product actually does.
Your first report is ready minutes after connecting your server
Choose a plan, your Sentinel account is created automatically, connect your server. If you have questions, write to our team.