Product Improvements: Flexible
Cloudways values its customers and their feedback! You can now give us your feedback on how we can improve Cloudways services, solution and products by pitching in your ideas!
89 results found
-
Security issue-Visible passwords in Dashboard needs immediate attention
Coming from different managed hosting, I just joined cloudways, only to be surprised that sufficient security for protecting passwords is not in place. I can see the passwords are visible to me but also to the support agents that have access to the same area and hence openly visible to them. They can see Wordpress password ( which is not issue, as they told me it is default one and if changed in wordpress admin, will not be reflected here). My biggest concern is the sensitive passwords for SQL database and application credentials. The eye icon placed next to passwords…
3 votes -
Display remaining Lets encrypt SSL limit
SSL has rate limit for SSL certificates which is reset in 12hrs. This limit should be displayed on SSL page so that user can be careful.
3 votes -
Remove Server Signature for Improved Security
Provide a way to disable the server signature to improve security by not disclosing the server type and server software, along with other information, which could allow hackers to determine vulnerabilities by listing server and software specifications.
Thanks!
3 votes -
Allow closing shellinabox
The shellinabox service that runs on port 4200 is not secure enough, for a number of reasons:
* it accepts non-TLS traffic
* no multifactor authentication
* no battle-tested frontend webserver like nginx before itInstead of fixing all of these, perhaps just allow to disable this service like you allow for other services.
3 votes -
Ability to add multiple SSL certificates per application (neither wildcard nor SAN)
If we have a multisite, we need a wildcard SSL for the subdomains. However if we go further, and provide custom domain (domain mapping) the problem comes that the SSL certificate is only for our domain not the mapped. Would be great if we can (even manually) create more than one certificate. SAN certificates is not the good option, since:
- We are using the wildcard for the own subdomains.
- There is a hard limit with the 100 domains.
- All the custom domains would be listed as secondary domains in the certificate details.
3 votes -
Spectre and Meltdown
Please advise about specific measures did you take regarding Spectre and Meltdowns recent announced threats in order to give a word of trust to our final customers
3 votes
Cloudways
responded
Hi Filipe:
We’ve put up an update on our blog about Meltdown and Spectre: https://www.cloudways.com/blog/protection-against-meltdown-and-spectre/
Cloudways Team
-
Please make your cloud server SOC2 compliant.
Please make your cloud server SOC2 compliant.
3 votes -
IP Ranges
Need to the ability to save IP ranges to security rather than one at a time.
3 votes -
Add user agent exclusion in immunify360 firewall rules
I would like to be able to add a user agent exclusion to the new immunity firewall, so for example not be blacklisted for screaming frog spider scans
maybe also the possibility to add ip whitelist via api service
2 votes -
Blacklist and block IP addresses
Via the Bot Protection section, which is Malware, it would be really beneficial to be able to click a red X (next to the whitelist green check) to block and blacklist an IP listed in the log.
2 votes -
2 votes
-
Let server admins (not just account owners) mute alerts OR let server admins disable vulnerability alerts
The "Alert: Vulnerabilities detected on your application" emails can only be disabled by account owners by muting the alerts (here's how: https://support.cloudways.com/en/articles/5119834-how-to-mute-cloudways-bot-notifications). We have their sites set up with automatic plugin updates and that works fine for us. These alerts are making our customers worried for no good reason, and it's making maintenance more of a pain for me since I now have to reassure them everything's fine.
It isn't a big annoyance for a customer to receive such an alert but try to imagine a web maintainer (like myself) having to answer multiple questions from concerned customers. We…
2 votes -
2 votes
-
Be able to name and order IPs
Hi !
It would be interesting to be able to create groups of IPs and name or tag these IPs in order to visually understand who has been given access to MySQL/SSH services.
Example :
External company 1: 127.0.0.1 127.0.0.2 127.0.0.3
External company 2: 172.0.0.1 172.0.0.2
Freelance dev: 120.0.0.1
My company: Ips list ....Thx
2 votes -
Allow API access to be granular
I would like to use the API to do a Git deploy on select applications. I would write a script and put the script on a server. As that would be the only job that API key would do, I would like to limit it by that permission/function and also to what server and applications it could do a git pull on.
So I see two ways to do this, one would be attach the API key the the current user. And what that user has permissions to in the UI would be what that key would have.
Another would…
2 votes -
Security
Hi there,
I recently learned about the login lock feature at BigScoots.
The Login Lock feature allows for an extra layer of login security on the WP admin dashboard. You can read more about it at the link below:
https://blog.bigscoots.com/wordpress-optimized-portal-wpo/#admin-security-lock
Will Cloudways be releasing something similar soon? It would be great to have an extra layer of login security available for our sites.
2 votes -
Please make search feature in all Bot Protection data table.
so this make easier for user to find the ip addresses.
And you can make a specific fiture to make a whitelist IP Adresses.Also please make the pagination better, so user can go to specific page.
And also in the data table, please make a filter by country, ip, etc
2 votes -
Slow HTTP DoS (Denial of Service) Attack
Your all web servers are vulnerable to Slow HTTP DoS (Denial of Service) attacks.
Slowloris and Slow HTTP POST DoS attacks rely on the fact that the HTTP protocol, by design, requires requests to be completely received by the server before they are processed. If an HTTP request is not complete, or if the transfer rate is very low, the server keeps its resources busy waiting for the rest of the data. If the server keeps too many resources busy, this creates a denial of service.
Attack Details:
Time difference between connections: 10006 msThe impact of this vulnerability:
A…2 votes -
whitelist
Please add Remark Option with Whitelist IP address in Server Security Section. Right now its difficult to find out which IP is pointing to external important server and which is IP is added for temporary use. Deleting an IP by mistake can take us into trouble as some live App IP's are listed in Whitelist IP list.
2 votes -
Some form of account activity log viewable by the super admin or account holder
account activity log
2 votes
- Don't see your idea?