Open Security
In the EmailaPanel Customer workspace, open Security or search the exact tool label. Customer security controls never become server-wide firewall/WAF or root grants. Read the detailed operational guide before making changes. The table lists every requested leaf in this group. A connected destination remains subject to current local permissions, resource ownership, installed capability, licence and fresh verification. It is not a production acceptance claim.
Complete tool reference
| Tool | Destination and behavior | Permission or limitation |
|---|---|---|
| SSL / TLS Status | Websites; choose the authorized website first; SSL tab | Current local Customer session, own account and feature policy |
| Install SSL Certificate | Websites; choose the authorized website first; SSL tab | Current local Customer session, own account and feature policy |
| HTTPS Redirect | Unavailable in this checkpoint | A dedicated managed HTTPS-redirect switch is not implemented. Certificate issuance alone does not create this control. |
| Two-Factor Authentication | Security | Current local Customer session, own account and feature policy |
| IP Blocker | Unavailable in this checkpoint | Customer per-website IP blocking is not implemented; global firewall controls remain Admin only. |
| Directory Privacy | Unavailable in this checkpoint | Password-protected directory policy and credential service are not implemented. |
| Hotlink Protection | Unavailable in this checkpoint | Hotlink-protection policy is not implemented. |
| Leech Protection | Unavailable in this checkpoint | Protected-directory credential abuse controls are not implemented. |
| ModSecurity | Unavailable in this checkpoint | Customer ModSecurity rules/toggle is not implemented; reviewed WAF policy is currently Admin only. |
| SSH Access | Websites; choose the authorized website first; Applications tab | Current local Customer session, own account and feature policy |
Make and verify a change
Select the intended owned resource and load its current detail. Read impact, current revision, applicable preview and confirmation before an explicit submission. If the server requires fresh authentication, complete its password/MFA flow and submit the reviewed request again; no write is automatically replayed. Keep the durable operation ID and inspect the final resource/service state.
When a tool is missing or denied
Check the current role/grants, installed version and actual capability. A menu label marked unavailable has no supported action to force. Source updates can be newer than your installed kit; they do not automatically add hosting acceptance. Preserve the safe operation/correlation reference and inspect original state before retrying an interrupted change. Do not disable confinement, modify private journals or substitute another account to bypass denial.