Site Lock guards a website's document root by recording a SHA-256 hash of every file and comparing the live tree against that snapshot on demand. Each site can hold several snapshots; an integrity check reports files that were added, modified or deleted since the one you pick, and a restore copies the recorded files back over the docroot. There is also an optional immutable lock that sets the chattr +i flag on the docroot so nothing — including a compromised PHP process — can write to it until an admin unlocks it again, which means you must unlock before any legitimate deploy or CMS update.

Beyond on-demand checks, a per-site watch mode registers the domain with a Go watcher running as the vinza-sitelock-watch systemd unit, installed by the plugin's install.sh; it uses inotify and appends detections to an alert log the page reads back. All filesystem work happens through the root agent, and on multi-node installs snapshots, the watcher and the alert log all live on the node that actually hosts the site, so the plugin resolves each domain to its node before acting. Website owners can snapshot, check, restore, lock and watch their own domains only — every tenant action re-verifies domain ownership against the same ABAC rules the Websites page uses — while the watcher service status stays admin-only. Snapshots are stored under /var/lib/vinzapanel/sitelocks, and the plugin cleans them up when a website is deleted. If Go is absent at install time and no prebuilt binary matches your architecture, the watcher will not run and only the manual snapshot/check/restore path is available.

Each site can exclude paths (caches, uploads, logs) from the integrity check and the watcher, and have an hourly or daily integrity check run as root from cron. Added or modified files are scanned with ClamAV and Vinza Scanner when present; infections are reported in the check and the alerts, never deleted. With panel 1.3.78 or later, snapshots leave excluded paths out and a restore never deletes them; on older panels snapshots cover the whole document root and a restore is refused while excludes are set.

Min Panel Version

1.0.0

Platform

Ubuntu 20.04+ / 22.04+ / 24.04+

License

Paid license required

Hooks

website_deleted

VinzaPanel handles installation automatically via the Vinza Store. Make sure the panel agent has internet access to download dependencies.

1.0.8 — New icon in the shared flat style. 1.0.7 — Confirmation prompts use the panel's own dialog (with a title and a clear action button) instead of the browser's confirm() box. 1.0.6 — Per-site exclude paths (cache/, uploads/, *.log … with suggested defaults) left out of the integrity check, the real-time watcher and scheduled checks. Scheduled integrity checks, hourly or daily per site, run as root from cron, with changes alerted. Added and modified files are virus-scanned (ClamAV, and Vinza Scanner when installed) and infections are shown in the check result and the alerts — never deleted. The integrity check result lists the changed files again (it always said there were no changes). 1.0.5 — File changes caught by the real-time watcher now raise an alert outside the Site Lock page: one per check (at most once a minute), not one per file, in the bell and — on panel 1.3.78+ — the admin's email/Telegram/webhook channels; website owners are alerted for their own sites. 1.0.4 — Snapshots of a deleted site on a node are removed on that node. The watcher uses the binary for this server's architecture, and updating replaces it while it runs. Security: names shown in the page (from the server, its sites or its users) are passed to buttons safely; a quote in one could run script in the admin's browser. 1.0.3 — The real-time watcher works: its source did not compile and no prebuilt binary was shipped, so the watcher service was never created and Watch failed with "Unit vinza-sitelock-watch.service not found". Updating sets the service up on servers that are missing it. 1.0.2 — Snapshot storage is unique per domain. 1.0.0: Initial release. Snapshot, integrity check, restore, and immutable lock via agent.

Use VinzaPanel's REST API to download and install this app programmatically.

Download app files

HTTP

POST /plugins/api/download/site-lock/
Content-Type: application/json

{
  "panel_version": "1.0.0"
}

Example response

JSON

{
  "success": true,
  "plugin_id": "site-lock",
  "version": "1.0.8",
  "download_url": "..."
}