Native option to restrict/disable sPanel login access via hosted client domains
Hello SPanel Team,
Provide a native, global setting in the Admin Panel to disable or restrict sPanel access via individual client domains (e.g., [domain.com/spanel](https://domain.com/spanel) or spanel.domain.com), allowing administrators to enforce a single, secure hostname for all control panel logins.
The Problem:
Currently, sPanel is accessible out-of-the-box via any hosted domain on the server. From a security, compliance, and strict white-label perspective, exposing the login portal on every single client domain increases the attack surface (brute-force attempts, automated scanners) and looks less professional.
While manual Nginx/Apache configuration tweaks can block or redirect these requests, these workarounds are prone to being overwritten whenever SPanel performs an automated system or control panel update.
Proposed Solution:
Introduce a global toggle switch in the Admin Panel (under Security or Server Settings) such as "Disable Control Panel Access via Hosted Domains".
When enabled:
Any attempt to access
/spanelor thespanel.subdomain on individual user domains should either return a 404 Not Found / 403 Forbidden or redirect directly to the main secure server hostname (or a customized global login URL).Admin and User panel traffic will be securely centralized through the master server hostname.
This native feature would significantly enhance server hardening, prevent update-overwrites, and offer better brand isolation for agencies and VPS administrators utilizing SPanel.
Thank you!
Comments (0)
Replies have been locked on this page!