Hosting panels

Some things a plugin cannot do by itself: adding a cron job, setting a PHP option such as auto_prepend_file, installing ClamAV. For those, Qartvelo Guard gives you steps, and it writes them for your hosting panel first, with its own menu names, followed by generic steps under "Other ways".

How the panel is detected

The plugin looks only at folders, files, constants and environment variables that belong to a panel. It never runs a program. A file that belongs only to the panel (its install folder, a host constant) makes the detection Sure; a matching site folder layout alone makes it Likely. The result is kept for 12 hours.

Kind	Recognised
Control panels	cPanel, Plesk, DirectAdmin, CyberPanel, aaPanel / BT Panel, HestiaCP, VestaCP, CloudPanel, CWP (Control Web Panel), ISPConfig, Virtualmin, Webmin, FASTPANEL, ISPmanager
Server platforms	RunCloud, GridPane, SpinupWP, Ploi, Laravel Forge, Cloudways, Hostinger (hPanel)
Managed WordPress	WP Engine, Kinsta, SiteGround, Pantheon, Pressable, Flywheel, GoDaddy Managed WordPress, WordPress.com
Local development	Local, DDEV, Lando, MAMP, XAMPP, Homebrew (macOS), Docker

The plugin also reads the web server (Apache, nginx, LiteSpeed, OpenLiteSpeed) and how PHP runs (PHP-FPM, LiteSpeed API, Apache module, CGI). Those decide, for example, whether the guard goes into .htaccess or .user.ini, even when no panel is found.

Choosing the panel yourself

If the detection is wrong, open Settings > Advanced > Server health, click Change next to "Hosting panel" and pick it under Instructions follow:

• Detect automatically, the default.
• Any panel from the list above.
• Other / not listed, which shows the generic steps only.

The wizard's environment step has the same Change link. Your choice is marked "Chosen" wherever the panel is named.

What changes per panel

• Early upload guard: the panel's way to set auto_prepend_file comes first and is marked recommended, with the step to restart PHP if the panel needs one. See Early upload guard.
• Real cron: where the panel keeps cron jobs and which user they run as. Plesk gets "Run a PHP script" tasks with the script path and arguments apart. See Real cron.
• ClamAV: the panel's own package or plugin where it has one (cPanel, DirectAdmin), or a note when its ClamAV only scans mail. See ClamAV and maldet.
• Web server rules: where to put the rule that blocks PHP in uploads (for example Plesk's "Additional nginx directives" or CyberPanel's Rewrite Rules).
• Data folder: where a folder outside the web root may live, for example next to public_html on cPanel, or inside the subscription folder on Plesk because of open_basedir.
• Clean core reinstall: the panel's file manager menus for upload, extract and move. Hosts that manage WordPress core themselves (WP Engine, Kinsta, Pantheon, WordPress.com, Pressable, Flywheel) are told to ask support instead.
• Managed hosts: when a task is impossible there (no server cron, no root access), the plugin says so and names the host's alternative, or says the plugin keeps protecting the site without it.

The downloadable security report and the developer instructions file include the detected panel too, so a developer gets the same steps.