ZYSENS_
ZYSENTINEL v1.6.4
v1.6.4
Security plugin for aaPanel • Free (open source), Pro, Max

Your aaPanel,
guarded in layers.

ZySentinel adds a web application firewall, threat scoring, port control, and malware scanning to aaPanel, all managed from one dashboard inside the panel. Start with the free open-source edition and move to Pro or Max when you need automatic blocking and deeper protection.

Install the Free edition Compare plans

Source code on GitHub ↗

Web application firewall
OWASP CRS
Coraza on Nginx, ModSecurity on Apache and OpenLiteSpeed, plus ZySentinel rules for sensitive files, scanners, and bots.
Threat scoring
From your logs
Scans, brute-force logins, and attack tools raise an IP's score. Pro and Max block it at the firewall automatically.
Malware scanning
ClamAV + heuristics
Check website folders for malware and webshells. Max adds real-time upload protection and automatic quarantine.
Editions
Free · Pro · Max
Free is open source under the Apache License 2.0. Pro and Max are monthly or yearly subscriptions.
// Live monitoring

See attacks and requests as they happen

The Total Attackers and Total Requests dialogs in ZySentinel show where traffic comes from, what it asks for, and what was stopped. This preview uses sample data.

Illustration with sample data
Active threat radar
Scoring hostile IPs from access logs
0 attackers (sample)
LIVE ATTACK STREAMWAF + FIREWALL

    In the plugin, these views show your server's real traffic on a world map, with a Detail tab listing every IP and request. Total Attackers is included in Max. Map data: Natural Earth.

    // Why ZySentinel

    Security that fits the way you run aaPanel

    aaPanel makes it simple to run websites on Linux. ZySentinel adds the security layer around them, with settings and alerts in the same panel.

    Easy to run

    Install from the aaPanel App Store and manage rules, alerts, and scans from one dashboard. Firewall safeguards keep SSH and the aaPanel port reachable, so a wrong rule does not lock you out.

    Several layers, one view

    The WAF filters requests, log scoring catches repeated attacks, the firewall blocks at the kernel, and scanners check the files on disk. Each layer covers what the others can miss.

    Fits your stack

    Works with Nginx, Apache, and OpenLiteSpeed on common Linux distributions. Pro and Max also support servers without a control panel, cPanel/WHM, DirectAdmin, and CyberPanel.

    Transparent by design

    The Free edition's source code is public. Every release ships with SHA-256 checksums that the updater verifies, and your logs, scan results, and quarantined files stay on your server.

    // Features

    Protection for the server and every website on it

    Each card shows which plan includes it. Everything is managed from the ZySentinel menu in aaPanel.

    Web application firewall

    The OWASP Core Rule Set runs on Coraza (Nginx) or ModSecurity (Apache, OpenLiteSpeed). ZySentinel rules add protection for sensitive files such as .env and .git, known scanners, and SQL injection, XSS, and path traversal attempts. Manage IP and URL allow and block lists, as plain paths or regular expressions.

    Free: 1 websitePro: 5 websitesMax: unlimited + premium rules

    Threat scoring and IP blocking

    ZySentinel reads your web server access logs and scores each IP by behavior: vulnerability scans, brute-force logins, and attack tools. Free shows the scores for review. Pro and Max block high-scoring IPv4 addresses and IPv6 prefixes automatically, and add country blocking and public blocklists.

    Free: monitoringPro: automatic blockingMax: learned rules, custom thresholds

    Firewall and port control

    Built on iptables and ipset in the Linux kernel. Open and close ports, block IP addresses, and turn on panic mode from the dashboard, while SSH and the aaPanel port stay protected from accidental lockout.

    Free: HTTP, HTTPS, SSHPro: + FTP and mailMax: all ports, kernel rules

    Malware and webshell scanning

    Scan website folders with ClamAV and Rkhunter. Pro adds scheduled scans and custom paths with ransomware and online gambling (judol) content detection. Max adds Sweeper, a webshell scanner with automatic quarantine, and real-time upload protection.

    Free: manual scanPro: scheduled scanMax: Sweeper, upload protection

    Process and outbound guard

    Watches the processes started by the web server account, a common sign of a compromised site. Free reports what it finds. Pro and Max stop unauthorized processes, keep a whitelist for the ones you trust, and block unexpected outbound connections with Egress Guard.

    Free: report onlyPro: stop and whitelistMax: EDR and anomaly view

    Vulnerability insight and alerts

    Pro and Max send alerts to your webhook, restart stopped protection services automatically, and show events per website. Max adds CVE Advisor, which checks installed software against a signed CVE feed and can apply virtual patches in the WAF.

    Pro: webhook alertsPro: self-healingMax: CVE Advisor
    // Plans and pricing

    Start free. Upgrade when your server needs more.

    One plugin with three levels. Upgrade from the plugin's Plans & Upgrade dialog; your settings stay in place.

    Currency

    Free

    Open source
    Free
    forever, no license code

    For one website, or to try ZySentinel on your server.

    • WAF with OWASP CRS for 1 website
    • Threat scoring dashboard (monitoring)
    • Manual IP blocking and port control for HTTP, HTTPS, SSH (up to 10 rules)
    • Manual malware scan with ClamAV and Rkhunter
    • Source code under the Apache License 2.0
    Install Free

    Pro

    For production servers
    Loading price…

    For servers that need protection running on its own.

    • Everything in Free
    • WAF for up to 5 websites
    • Automatic IP blocking, country blocking, public blocklists
    • Scheduled and custom-path malware scans
    • Process Guard, Egress Guard, web file integrity
    • Webhook alerts, self-healing, traffic and event views
    • Servers without a panel, cPanel/WHM, DirectAdmin, CyberPanel
    How to upgrade

    Max

    Complete protection
    Loading price…

    For hosting providers and servers with many websites.

    • Everything in Pro
    • WAF for unlimited websites with premium rule packs
    • Real-time upload protection and Sweeper with auto quarantine
    • CVE Advisor with virtual patching
    • Learned rules, custom thresholds, ZySens reputation feed
    • Port Inventory & Guard, kernel and managed rules, all ports
    • Multiple alert channels, EDR and anomaly view
    How to upgrade

    Prices come from the ZySens license server and are shown again before you pay. Pay in Rupiah with Midtrans (each period is a separate order) or in US dollars with PayPal (renews automatically until you stop it). Each license is for one server. See the Terms of Service for renewal, stopping, and refunds.

    // How it works

    Four checks between an attacker and your website

    What happens to a request, and to the files on your server, while ZySentinel is running.

    STEP 1 // WAF

    Request filtering

    The WAF checks each HTTP request (headers, parameters, and body) and blocks known attack patterns before they reach your application.

    STEP 2 // SCORING

    Log-based scoring

    Access logs are analyzed continuously, outside the request path. Each IP gets a score from scans, failed logins, and attack tools.

    STEP 3 // FIREWALL

    Kernel-level blocking

    IPs above the threshold are added to an ipset and dropped by the Linux firewall before they reach the web server. Automatic in Pro and Max.

    STEP 4 // FILES

    File and process checks

    Scanners check website files for malware and webshells, and the process guard watches what the web server account runs.

    // Installation

    Install in three steps

    Use the aaPanel App Store import (recommended) or the command line over SSH as root. The installer sets up the services, firewall rules, and the WAF for your web server.

    Install ZySentinel on aaPanel v1.6.4
    1. Download zysentinel-v1.6.4.zip from GitHub Releases.
    2. Import it in aaPanel: App Store → Import third-party plugin (top right), then choose the ZIP file.
    3. Open ZySentinel from the App Store. The installer runs automatically and the dashboard is ready when it finishes.
    git clone -b v1.6.4 https://github.com/omysurya/zysentinel.git /www/server/panel/plugin/sentinel && cd /www/server/panel/plugin/sentinel && bash install.sh install

    Clones the release tag into the aaPanel plugin folder and runs the installer.

    curl -fsSL -o /tmp/sentinel.zip https://github.com/omysurya/zysentinel/releases/download/v1.6.4/zysentinel-v1.6.4.zip && mkdir -p /www/server/panel/plugin && unzip -q /tmp/sentinel.zip -d /www/server/panel/plugin/ && cd /www/server/panel/plugin/sentinel && bash install.sh install

    Downloads the release ZIP, extracts it into the aaPanel plugin folder, and runs the installer.

    cd /www/server/panel/plugin/sentinel && bash install.sh update

    Updates the plugin in place and keeps your settings, lists, and alert configuration. You can also update from the plugin with one click.

    Pro and Max

    Pro and Max are delivered as the ZySentinel Pro package, starting with version 2.0. In the plugin, open Plans & Upgrade, choose a plan, and pay with Midtrans or PayPal. The license binds to your server's public IP address and activates as soon as the payment is confirmed.

    // FAQ

    Frequently asked questions

    Short answers. The Terms of Service and Privacy Policy have the full details.

    What is the difference between Free, Pro, and Max?
    Free protects one website with the WAF and shows threat scores for you to review. Pro adds automatic blocking, scheduled scans, process and outbound guards, alerts, and support for more panels, for up to 5 websites. Max includes everything, for unlimited websites, plus upload protection, Sweeper, CVE Advisor, and premium WAF rules.
    Is the Free edition really free? Can I use it commercially?
    Yes. Free has no time limit and needs no license code. It is released under the Apache License 2.0, which allows commercial use under the terms of that license.
    Will ZySentinel slow down my websites?
    Log scoring runs outside the request path and does not delay visitors. The WAF inspects each request, which adds some processing; you can set a website to monitor mode, or exclude trusted URLs such as a JSON API from the OWASP rules only, from the WAF menu.
    Can it block legitimate visitors?
    Any automated blocking can. ZySentinel lets you allow IPs and URLs, review decisions, and unblock with one click. Pro adds a review queue, and Max learns from your decisions. Start in monitor mode if you want to see the results before blocking.
    How do I upgrade to Pro or Max, and how do I pay?
    In the plugin, open Plans & Upgrade, choose a plan and a monthly or yearly period, then pay in Rupiah with Midtrans or in US dollars with PayPal. The plan activates as soon as the payment gateway confirms the payment.
    Can I use one license on several servers?
    No. Each license is bound to one server's public IP address. To move a license to a new server, contact us; the old server returns to Free at its next license check.
    Can I stop my subscription? Do you give refunds?
    You can stop at any time from Plans & Upgrade, from PayPal, or by contacting us. Your plan stays active until the end of the period you paid for, plus a 3-day grace period. Payments are non-refundable, except where the law requires a refund.
    What happens when a paid plan ends?
    The server returns to Free automatically. Your configuration and data on the server are kept, and paid features come back when you renew.
    Does ZySentinel send my data to you?
    Logs, attack events, scan results, and quarantined files stay on your server. Pro and Max send a license check about every 6 hours (license code, server IP, a hashed machine ID, plugin version, and component fingerprints). Usage statistics are on by default and can be turned off in Settings. See the Privacy Policy.
    What if my server cannot reach the license server?
    Paid features keep working for as long as the last license token is valid, as stated in the Terms of Service. Free features never depend on our license server.
    How do I report a bug or a security issue?
    Use Feedback & Report Bugs in the plugin, open an issue on GitHub for the Free edition, or email [email protected]. Please report security issues privately by email, not in a public issue.
    // Compatibility

    Requirements and compatibility

    What ZySentinel runs on, and what we test it on.

    ItemDetails
    Control panelaaPanel (tested on aaPanel 8.0.7). Pro and Max: also servers without a control panel, cPanel/WHM, DirectAdmin, and CyberPanel.
    Operating system64-bit Linux supported by aaPanel, including Debian, Ubuntu, AlmaLinux, and Rocky Linux. Tested on Ubuntu 22.04, Ubuntu 24.04, and AlmaLinux 9.
    Web serverNginx with the Coraza WAF module, built for your installed version (tested on Nginx 1.31). Apache and OpenLiteSpeed with ModSecurity.
    Firewalliptables and ipset, for IPv4 and IPv6.
    Malware scanningClamAV and Rkhunter, installed by the plugin when they are missing.
    LicenseFree: Apache License 2.0, source code on GitHub. Pro and Max: ZySentinel End User License Agreement, activated with a license code.
    Your dataLogs, attack events, scan results, and quarantined files are processed and stored on your server.

    Protect your first website today

    Install the Free edition in a few minutes. Upgrade from inside the plugin whenever you are ready.

    Install the Free edition