Security on a reseller hosting server is not one feature, it is four separate technologies, each solving a different threat, layered on top of each other. A provider that has only one or two of them is not "somewhat secure" — a missing layer is a completely open gap for the specific threat that layer is meant to stop. Here is what each one actually does, in the order a request or attack would actually encounter them.
Layer 1: CloudLinux — The Foundation
CloudLinux is the operating system itself, and it is the foundation every other security layer here builds on. Standard Linux distributions have no concept of "this cPanel account should be isolated from that one" — CloudLinux adds that concept at the OS level, which is what makes real multi-tenant isolation possible on a shared reseller server at all.
Layer 2: CageFS — Filesystem Isolation
CageFS gives every individual cPanel account its own virtualized filesystem view. In practice, this means:
- One client cannot see another client\'s files, even if they somehow gained shell access
- One client cannot view server-wide configuration files that could reveal exploitable information about the server or other accounts
- A vulnerability in one client\'s outdated WordPress plugin cannot be used to pivot into a neighboring account\'s files — each account\'s process genuinely believes it is the only one on the server
Without CageFS, a compromised account on a shared server is a much bigger problem — the compromise can potentially spread laterally to other accounts sharing the same physical server.
Layer 3: LVE — Resource Limiting
LVE (Lightweight Virtual Environment) caps how much CPU, RAM, I/O throughput, and number of running processes each individual account can consume. This is a performance-and-availability protection more than a traditional security one: it prevents one account\'s traffic spike, runaway script, or even a deliberate resource-exhaustion attack against that specific account from degrading performance for every other account on the same server.
Layer 4: Imunify360 — Active Malware Defense
Imunify360 is an AI-driven security suite that continuously scans every account for malware, automatically quarantines or cleans infected files, and includes a web application firewall that blocks common attack patterns (SQL injection attempts, known exploit signatures) before they reach a vulnerable script. It learns from attack patterns observed across a large number of servers, which lets it often block novel threats faster than a purely signature-based scanner would.
Layer 5: CSF — The Network Firewall
CSF (ConfigServer Security & Firewall) operates at the network level, below the application layer Imunify360 protects. Its main jobs on a reseller server:
- Throttling and blocking repeated failed login attempts (brute-force protection) across cPanel, WHM, email, and FTP
- Blocking port scans and other network-level reconnaissance attempts
- Providing a configurable rule set for blocking known-bad IP ranges
How These Five Layers Work Together
| Threat | Layer That Stops It |
|---|---|
| Brute-force login attempts against cPanel/email | CSF |
| Malware uploaded through an outdated plugin | Imunify360 |
| One client\'s compromised account trying to access another client\'s files | CageFS |
| One client\'s traffic spike or script slowing down every other account | LVE |
| The underlying isolation making all of the above enforceable at all | CloudLinux |
Why All Five Matter, Not Just Some
A provider with Imunify360 but no CloudLinux still has malware scanning, but no account isolation — a compromised account can still potentially affect its neighbors. A provider with CloudLinux but no Imunify360 has isolation, but no active malware defense within each isolated account. Ask any prospective provider about all five specifically, not just whichever one they lead with in marketing copy.
What This Means for You as a Reseller
Every one of your client\'s sites inherits whatever security stack your underlying reseller server runs — you cannot layer better security on top of a provider that\'s missing one of these pieces underneath. This is one of the most consequential, and most overlooked, differences between reseller hosting providers at similar price points.
Every WebsNP reseller hosting plan runs the full stack — licensed CloudLinux with CageFS and LVE, Imunify360, and CSF — as standard, not an add-on. See our reseller hosting plans for details.