Security tools
Use the FeatherPanel security pages. FeatherZeroTrust malware scans, rate limits, banned IPs, blocked e-mail domains and the AbuseIPDB integration.
On this page
The Security group in the admin sidebar holds these pages. For general hardening (HTTPS, keys, proxies) see Security hardening.
FeatherZeroTrust
FeatherZeroTrust looks for malicious files on game servers. It reads server files through each node’s FeatherWings API, so nothing extra is installed on the node.
| Tab | Use |
|---|---|
| Scanner | Scan one server (deep scan of a directory with a max depth) or a batch of servers, with a live feed and results. |
| Suspicious Hashes | The SHA-256 hash database. Add hashes by hand, confirm or delete them in bulk, check up to 1000 hashes at once, or import recent samples from MalwareBazaar. |
| Scan History | Logs of the scheduled scans. |
| Configuration | All settings below. |
Configuration:
- Basic settings: System Enabled (master switch), Auto Suspend for servers with detections, scan interval in minutes, maximum directory depth, maximum file size, and a maximum JAR size below which JAR files count as suspicious.
- Notifications: a Discord webhook for alerts.
- MalwareBazaar: enable imports, optional API key, latest 100 samples or last hour, import limit (1 to 1000), maximum sample age, allowed file types, blocked tags, auto-confirm and require-signature options.
- Exclusions: ignored extensions, files and paths.
- Threat indicators: suspicious content patterns (one per line), malicious process names, miner and WhatsApp bot indicators.
- Thresholds: high CPU, high network and small volume size.
When System Enabled is on, the panel cron runs a scan of every server on every node at the configured interval.
Rate limits
Rate Limits has a global switch and a table of API routes, each with its own limits per second, minute, hour and day, a namespace, an on or off switch and a reset action. Save All writes the changes. How limits are counted and what clients receive is in Rate limits and errors.
Banned IPs
Ban an IPv4 or IPv6 address or a CIDR range, with an optional duration (30m, 24h, 7d, 1w, 1h30m; empty means
permanent) and a reason. Registrations from a banned IP get the IP_BANNED error, and automatic account creation
through OIDC or Discord is refused. Expired bans stay in the list marked Expired.
Blocked email domains
With Enforce blocked domains on (email_domain_blocking_enabled), new registrations and e-mail changes are rejected
when the domain matches the list. Subdomains match too: sub.example.com matches example.com.
Add domains one at a time or use Bulk import: the bundled disposable-domain preset, a plain-text URL (redirects are not
followed and private addresses are rejected) or pasted text, one domain per line with # comments.
AbuseIPDB
Turn on abuseipdb_enabled and add an API key in Settings, Security. Then:
| Setting | Default | Effect |
|---|---|---|
abuseipdb_check_on_register | false | Check the IP of each new registration. |
abuseipdb_min_confidence_score | 75 | Score (0 to 100) at which an IP counts as reported. |
abuseipdb_max_age_days | 90 | Only count reports from the last N days. |
abuseipdb_register_action | block | block refuses the sign-up, log only records it, auto_ban creates the account and bans it. |
The AbuseIPDB page scans the first and last IPs of all users and lists flagged ones, and checks a single IP. When you ban a user you can also report their IPs to AbuseIPDB with one or more categories and a comment.
Frequently asked questions
Files of game servers on your Wings nodes. It hashes files and compares them with its hash database, and checks content patterns, miner and bot indicators and small JAR files.
The IP ban list is checked when accounts are created, including automatic sign-up through OIDC and Discord. To lock out an existing account, ban the user.
Yes. Blocked email domains has a bundled disposable-domain preset, plus import from a URL or pasted text.