Built for Speed.
Engineered for Defense.
A comprehensive technical breakdown of all 11 RoninArmor defense engines. Discover how our coordinated security daemons intercept attacks across the network, web server, application runtime, and file storage layers simultaneously.
Zero-Second Malware Neutralization
Running a daily cronjob to scan files is not enough if a hacker uploads a webshell and executes it immediately. RoninArmor monitors your web accounts and temporary upload folders continuously in real time.
The exact moment a file is written or changed, it is analyzed against thousands of active signature patterns. If malicious code is detected, the system immediately strips execution permissions (0000 lockdown), isolating the threat before it can ever be requested in a browser.
Immunity Lockdown
Prevents code execution while preserving original file data safely.
Content Filters
Identifies and blocks injected gambling links, adult spam, and phishing scripts.
In-Memory Application Runtime Protection
What happens if an attacker targets an unpatched security hole inside an outdated WordPress plugin or custom web application?
RoninArmor solves this by inspecting behavior directly inside the active PHP runtime process in memory. When a compromised script attempts to execute unauthorized system shell commands, run obfuscated eval chains, or read sensitive operating system files, RASP terminates the action before commands can execute.
Drive-Safe Web Application Firewall
During sustained traffic floods or automated vulnerability sweeps, traditional web firewalls often crash servers by exhausting disk write buffers. Writing millions of attack lines directly to disk slows down all websites hosted on the server.
RoninArmor eliminates this issue entirely. High-frequency audit logs are streamed to virtual memory, rotated automatically, and cleaned in memory. Your physical enterprise drives are protected from premature wear, and web latency remains stable at all times.
Account Resource Governor & Stability
In shared and multi-tenant hosting environments, one runaway script or rogue cryptocurrency miner can consume 100% of available CPU cores, slowing down every other website on the machine.
The Resource Governor enforces fair CPU, memory, and disk input/output limits on a per-user basis. It includes intelligent CPU bursting for legitimate visitor checkouts, while continuously restricting chronic resource abusers and rogue background tasks.
- Prevents runaway websites from crashing neighboring accounts.
- Automatically identifies and terminates unauthorized background cryptocurrency mining loops.
All 11 Integrated Security Engines
Explore the complete lineup of autonomous daemons powering RoninArmor. Every engine operates in unison to deliver total infrastructure defense without performance penalties.
Real-Time Antivirus & File Guardian
Monitors file changes continuously across customer accounts and temporary directories. Neutralizes webshells and phishing scripts immediately with zero permissions (chmod 0000). Filters injected gambling keywords, adult spam, and stores quarantined threats in a secure vault.
Web Application Firewall (WAF)
Inspects web visitors before requests reach backend scripts or databases. Automatically blocks SQL Injections, Cross-Site Scripting (XSS), Local File Inclusions, and automated vulnerability scanners. Includes instant zero-day virtual patching for WordPress, WooCommerce, and Joomla plugins.
Aegis Network Firewall & LFD
Defends all server network ports against intrusion and brute-force guessing attacks. Automatically bans IP addresses that repeatedly fail login attempts on SSH, FTP, cPanel, DirectAdmin, Plesk, and Webmail. Mitigates TCP SYN floods, detects port scans, and blocks unauthorized outbound SMTP spam scripts.
PHP Runtime Defense (RASP)
Protects websites from inside the PHP execution process across all installed versions from PHP 5.6 to 8.5. Even if customer sites run unpatched or vulnerable plugins, RASP monitors script actions in memory and immediately stops unauthorized command line execution, nested eval backdoors, and file tampering.
Capman Captcha & Flood Gateway
Under heavy HTTP flood attacks, Capman activates an automated Virtual Waiting Room. It filters botnets using invisible browser verifications, math puzzles, and image captchas while letting genuine visitors and search engine crawlers through.
MailGuard Anti-Spam Gateway
Connects directly into Exim and Postfix mail stacks. Scores spam heuristics, verifies SPF/DKIM/DMARC alignment, inspects attachment file signatures for disguised executables (.exe, .vbs), and caps outbound volume per user to protect your server IP reputation.
Multi-Provider EasySSL Automation
When primary certificate providers encounter rate limits or temporary outages, EasySSL automatically switches to alternative authorities (Google Trust, Let's Encrypt, ZeroSSL). Features pre-flight DNS checks and auto-rescue before expiration.
NetGuard Network Monitoring
Monitors network interfaces to detect bandwidth saturation, connection flood spikes, and abnormal packet rates per IP. Synchronizes continuously with global reputation feeds like AbuseIPDB to drop known malicious networks automatically.
AuthGuard Root 2FA Sentinel
Locks down administrative access at the operating system level. Requires multi-factor verification on direct SSH root logins, privilege elevation (su and sudo), and the Web Console via Telegram, Authenticator apps, Email OTP, or biometric passkeys.
Ronin DB-Scan Engine
Scans website database tables for hidden malicious injections, unauthorized administrator users, iframe redirects, and base64 scripts. Cleans infected database entries safely without corrupting site content.
Account Resource Governor
Enforces fair CPU, memory, and disk input/output limits per hosting account so a single runaway website can never crash neighboring accounts. Features CPU bursting for checkout spikes, restricts compiler execution in home folders, and terminates rogue cryptocurrency miners automatically.
Engine Specifications
Operational benchmarks measured across active production Linux hosting environments under sustained traffic.
| Architecture | x86_64, ARM64 |
| Software Architecture | Native Compiled Core |
| System Overhead | Low Resource Footprint |
| Inspection Latency | < 0.01 ms |
| Runtime Coverage | PHP 5.6 through 8.5 |
| Audit Storage | Virtual Memory (/dev/shm) |
Defense Pipeline Flow
How incoming requests and data transactions are evaluated across the network, web, application runtime, and filesystem layers in real time.
Network Filtering & Ingress Shield
NetGuard and Aegis Firewall inspect incoming TCP/UDP connections. Known attacker IPs, botnet nodes, and password brute-force offenders are dropped immediately before reaching web server processes.
Application WAF & Memory Logging
Capman checks visitor volume and challenges automated bots. Clean requests pass to the WAF, which blocks SQL injections, XSS, and exploit probes with audit logging streamed to temporary virtual memory.
Runtime Defense & Resource Governor
As scripts run, RASP monitors instructions in memory to block command execution, backdoor evals, and LFI traversals. Simultaneously, the Resource Governor enforces fair CPU and memory limits per account.
Deploy Complete Server Defense.
Replace fragmented security plugins with a unified, autonomous defense engine. Register for an account to deploy your server licenses in minutes.