Security out of the box

Protection at every level

Firewall, SSL, SSH keys, Fail2Ban, process isolation and security headers — configured and working right after you connect a server.

What's included in protection

Eight security subsystems, each solving its own task

UFW firewall

Presets for typical configurations, custom rules by port, protocol, policy and source IP. System rules are protected from accidental deletion.

SSL certificates

Automatic issuance via Let's Encrypt, renewal tracking, alerts 14 days before expiration, and uploading your own certificates.

SSH keys

RSA, ED25519, ECDSA. Bound to a specific user, support for password-protected keys, split into system and user keys.

Fail2Ban

Configurable ban time, find time, max retries. IP ignore list, bantime increment. Nginx filters: HTTP auth, bot search, limit requests.

Site isolation

Each site runs under a separate system user with an isolated home directory. Compromising one does not affect the others.

Basic Auth

Protect individual paths with username/password. Quick setup for staging environments or private sections.

Security headers

X-Frame-Options, X-Content-Type-Options, Referrer-Policy, hiding X-Powered-By. Enabled with a single toggle.

SSH monitoring

Notifications on login from a new IP, tracking of known IPs. You always know who connects to the server.

UFW firewall

Flexible firewall rules

Use ready-made presets or create custom rules: port, protocol (TCP/UDP/ALL), policy (ALLOW/DENY) and source IP. System rules are protected from deletion.

  • Presets: Web, SSH, MySQL, Redis
  • Custom rules with source IP filtering
  • System rules can't be deleted by accident
Firewall rules
6 rules
Port Protocol Policy Source Type
22 TCP ALLOW Any system
80 TCP ALLOW Any system
443 TCP ALLOW Any system
3306 TCP DENY Any system
5432 TCP ALLOW 10.0.0.0/24 custom
6379 TCP ALLOW 127.0.0.1 custom
SSL certificates
demo.deploykin.com
Let's Encrypt · Expires 2026-09-14
Active
blog.demo.deploykin.com
Let's Encrypt · Expires 2026-09-14
Active
staging.demo.deploykin.com
Let's Encrypt · Expires 2026-04-13
Expires in 12 days
api.demo.deploykin.com
Custom · Expires —
Pending
SSL certificates

SSL in one click and auto-renewal

Let's Encrypt выпускается из панели в один клик и дальше продлевается автоматически. Статусы: pending, active, expired, failed — always in view. Alert 14 days before expiration.

  • Auto-provisioning and auto-renewal via Let's Encrypt
  • Upload your own certificates (custom upload)
  • Notification 14 days before expiration

SSH keys

Support for RSA, ED25519, ECDSA. Each key is bound to a specific user. Password-protected keys for extra security.

deploy@production ED25519
System
john@macbook RSA 4096
User
ci-pipeline ECDSA
System

Fail2Ban

Automatic IP blocking on password brute-force. Bantime increment for repeat offenders. Nginx filters: HTTP auth, bot search, limit requests.

Ban Time
3600s
Find Time
600s
Max Retries
5
Bantime Increment
On
Ignore IPs
127.0.0.1, 10.0.0.0/8
Key vault

Your team's SSH keys — in one vault

Team keys are stored encrypted and rolled out to servers automatically. A new user gets the right keys immediately, and a bulk install pushes them to all servers at once.

  • A team vault with key encryption
  • Auto-install keys for new server users
  • Bulk sync to all servers at once
  • Rotation of the Deploykin service key
Team keys 3 keys
anna@studio ed25519 8 servers
ci-deploy ed25519 8 servers
deploykin-platform rsa system all servers
Private keys are encrypted and never handed out

Additional layers of protection

Process isolation, security headers and Basic Auth for private sections

User isolation

site_demo
/home/site_demo · demo.deploykin.com
site_blog
/home/site_blog · blog.demo.deploykin.com
site_crm
/home/site_crm · crm.demo.deploykin.com

Security headers

X-Frame-Options SAMEORIGIN
X-Content-Type-Options nosniff
Referrer-Policy strict-origin
X-Powered-By hidden

Basic authentication and SSH monitoring

Basic Auth
/admin/*
user: staging_admin
SSH logins
185.22.14.91 new IP
10.0.0.5 known
Site monitoring

Watching your site's security

On a schedule, Deploykin scans dependencies for vulnerabilities and watches for unexpected file changes. If something turns up, you get an alert.

  • Dependency audit: composer audit and npm audit
  • File-change tracking via git and a baseline
  • Configurable path exclusions
  • An alert and a report when issues are found
Security check shop.example.com
composer audit 0 vulnerabilities
npm audit 1 warning
File changes no changes
Last check: today, 04:00

Security enabled by default

Connect a server — firewall, SSL, Fail2Ban and isolation will be configured automatically.

We use cookies and the Yandex Metrica web-analytics service (including Session Replay) to improve the site. Details are in the privacy policy.