Security

DomePlus is built for agencies that need to show clients a hardened stack — without buying a separate security product.

Account & panel

• User and admin TOTP 2FA (recovery codes included)
• Optional Google SSO (OIDC) for login / register / link
• In-panel Security audit — automated posture score + manual pen-test readiness list
• SSH private keys encrypted at rest (CredentialVault)
• CSRF on panel; rate limits on auth and billing

Servers & sites

• Agent dual auth: Bearer token + X-Agent-Secret header
• Connect tokens expire after 24 hours
• Server Security panel: UFW, Fail2Ban harden/unban, nginx WAF, OS patch status
• WordPress malware scan (core checksums + PHP in uploads)
• Cloudflare DNS + security level / managed WAF / Under Attack Mode (Pro+)

Billing

• Card payment webhooks verified with signature checks + idempotency
• Crypto invoices with channel discounts (BTC / USDT / USDC)

Signed in? Open Security audit in the panel sidebar, or Server → Security on each VPS.