CloudLinux, CageFS & Imunify360: How Shared Hosting Security Works

The problem shared hosting has to solve

On shared hosting, dozens or hundreds of separate websites run on a single physical server. That is what makes it affordable. It is also what makes it risky if the server is not built correctly. Two problems have to be solved at once:

• The noisy neighbor. One site that suddenly gets a traffic spike, runs a runaway script, or gets hit by bots can consume all the CPU, memory, or disk I/O on the machine and slow every other site to a crawl.
• The hostile neighbor. One site that gets hacked, through an outdated plugin or a stolen password, can try to read its neighbors' files, steal their database credentials, and spread across every account on the server.

A plain Linux server with cPanel does very little about either problem by default. The combination of CloudLinux, CageFS, and Imunify360 is the industry's answer. Each handles a different layer, and they are designed to be used together.

CloudLinux and LVE: resource isolation

CloudLinux OS is a Linux distribution purpose-built for multi-tenant hosting. Its headline feature is LVE, the Lightweight Virtual Environment. LVE is a kernel-level cage around each hosting account that enforces hard limits on:

• CPU time and the number of CPU cores an account can use at once
• Physical memory (RAM), so one account cannot trigger out-of-memory conditions for the whole server
• Disk I/O and IOPS, the read and write throughput an account gets
• Entry processes and the number of concurrent PHP requests an account can run

The practical result is simple: when a single account hits its ceiling, only that account slows down. Every other site on the server keeps running normally. This is the difference between one website having a bad day and the entire server having a bad day. It is why resource isolation is the foundation the rest of the security stack is built on.

CageFS: filesystem isolation

Resource limits stop a site from starving the server. They do nothing to stop a compromised site from reading its neighbors. That is the job of CageFS.

CageFS gives every account its own virtualized filesystem. Inside the cage, an account sees its own home directory plus a curated, read-only set of system binaries and libraries it needs to run. It does not see:

• Other customers' home directories, websites, or uploads
• Other users' configuration files, including WordPress wp-config.php and .env files that hold database passwords and API keys
• The full server process list, or which other users and sites exist on the machine
• Sensitive system files that attackers normally read to plan privilege escalation

This closes off the single most common shared-hosting attack pattern. When an attacker compromises one weak site, their very next move is usually to read the server for other sites' database credentials and config files. CageFS makes those files invisible from inside a caged account, so a single compromise stays contained to the one account instead of becoming a server-wide breach.

SecureLinks and HardenedPHP

CloudLinux adds two more hardening features worth knowing about. SecureLinks blocks symbolic-link and hard-link attacks that attackers use to trick a privileged process into reading or overwriting files it should not touch. HardenedPHP back-ports security fixes to end-of-life PHP versions (for example PHP 5.6 and 7.x) that no longer get official updates, so a site that depends on a legacy application can run on a patched interpreter instead of an unpatched one.

Imunify360: active threat detection

CloudLinux and CageFS are about isolation: limiting what any one account can do and reach. Imunify360 is the active layer that looks for and blocks actual attacks and malware inside each account. It is several tools in one:

• Web Application Firewall (WAF). A ModSecurity rule set that inspects incoming HTTP requests and blocks known attack patterns (SQL injection, cross-site scripting, malicious uploads) before they reach the application.
• Intrusion detection and prevention. Monitors for suspicious behavior and automatically blocks offending IP addresses, with a cloud reputation database shared across many servers.
• Malware scanning. Scans files on a schedule and as they are uploaded, flagging or quarantining known malware signatures and suspicious code.
• Proactive Defense. Watches PHP scripts as they execute and blocks malicious behavior at runtime, which can stop brand-new malware that no signature exists for yet.
• Brute-force and login protection. Rate-limits and blocks repeated failed logins against cPanel, WordPress, and other dashboards.
• Patch management. Works with CloudLinux to apply kernel and PHP security patches, often without a reboot.

How the three layers fit together

These are not competing products. They are a defense-in-depth stack where each layer covers what the others cannot:

Isolation limits the blast radius of any single compromise. Detection works to prevent and clean the compromise in the first place. Remove any one layer and the other two have a bigger hole to cover. That is why reputable shared hosts run all three.

What this stack does NOT protect against

This is the part most hosting pages leave out, and it matters. Server-level security cannot fix insecure applications. No combination of CloudLinux, CageFS, and Imunify360 will:

• Patch a vulnerable WordPress plugin, theme, or core version that you have not updated
• Stop an attacker who has your real admin password because it was weak, reused, or phished
• Protect a site that leaks its own database credentials through debug output or a public backup file
• Save a site that installs a nulled (pirated) plugin or theme, which frequently ships with a built-in backdoor the owner invited in

How Ultra implements it

Ultra Web Hosting runs CloudLinux OS with LVE resource isolation and CageFS account isolation across our shared hosting and reseller hosting, with Imunify360 providing the WAF, malware scanning, and Proactive Defense layer on top. All of it runs on hardware we own and operate in our own datacenter, with on-site staff available 24/7. There is no separate security add-on charge on shared hosting plans, and our team monitors malware events directly so we can help review quarantines, confirm false positives, and restore clean files when something does slip through.