Native option to restrict/disable sPanel login access via hosted client domains

xmodmor shared this idea 5 days ago
Open Discussion

Hello SPanel Team,

Provide a native, global setting in the Admin Panel to disable or restrict sPanel access via individual client domains (e.g., [domain.com/spanel](https://domain.com/spanel) or spanel.domain.com), allowing administrators to enforce a single, secure hostname for all control panel logins.

The Problem:
Currently, sPanel is accessible out-of-the-box via any hosted domain on the server. From a security, compliance, and strict white-label perspective, exposing the login portal on every single client domain increases the attack surface (brute-force attempts, automated scanners) and looks less professional.

While manual Nginx/Apache configuration tweaks can block or redirect these requests, these workarounds are prone to being overwritten whenever SPanel performs an automated system or control panel update.

Proposed Solution:
Introduce a global toggle switch in the Admin Panel (under Security or Server Settings) such as "Disable Control Panel Access via Hosted Domains".

When enabled:

  • Any attempt to access /spanel or the spanel. subdomain on individual user domains should either return a 404 Not Found / 403 Forbidden or redirect directly to the main secure server hostname (or a customized global login URL).

  • Admin and User panel traffic will be securely centralized through the master server hostname.

This native feature would significantly enhance server hardening, prevent update-overwrites, and offer better brand isolation for agencies and VPS administrators utilizing SPanel.

Thank you!

0 votes

Comments (0)

Leave a Comment