Mandatory OTP / TOTP
Email OTP or an authenticator app on every sign-in — not a buried settings toggle.
Always onSecurity at DMS Panel isn't a single feature you can point to. It's a constraint that shapes the database tooling, the login flow, and the platform's own admin layer.
Most panels stop at a firewall toggle. DMS Panel runs eight distinct, industry-standard security tools per server, configurable individually, with a scored dashboard so you can see your actual security posture at a glance.
SSH root login enabled & firewall logs unchecked.
Antivirus scanning, including upload-time scanning of files as they land on the server.
Pattern-based malware and threat detection rules.
Rootkit hunter — scans for known rootkit signatures.
A second, independent rootkit detection pass.
File integrity monitoring — flags unexpected changes to system files.
Full system security auditing with a scored report.
Uncomplicated firewall, managed per server from the panel.
Automatic banning of IPs behind repeated malicious login attempts.
All eight run on a schedule you control, with historical scan reports, a security score and a dedicated security log so nothing gets buried.
Second factor isn't optional. Sessions are auditable. Failed attempts get locked out.
Email OTP or an authenticator app on every sign-in — not a buried settings toggle.
Always onOptional 24-hour device trust so OTP isn't demanded on every login from a known machine.
Automatic lockout after repeated failures, plus IP-based login blocking.
Full login history with “sign out my other device” if a session looks wrong.
SSH credentials encrypted at rest. Never rendered as plaintext in the UI.
AES-256-GCMEvery hosting panel eventually needs to kill a stuck query or a runaway connection. Most make that a single careless click away from an outage. DMS Panel's Database Healthview was built specifically so that can't happen by accident.
Platform staff need enough visibility to support customers and run the business, and nothing beyond that. DMS Panel enforces that line in code, not in a policy document nobody reads, and logs every Super Admin action that crosses it.
Every restriction above is enforced in code. Every Super Admin action is itself audit-logged.