The Security Score on your Meridian dashboard isn't a fixed grade. It's a live readout of three things: whether your SSL certificate is active, whether the web firewall is protecting your domain, and whether HTTPS redirect is enforced. If the score is lower than you'd like, check those three first.
Meridian is the newer cPanel theme (opt-in via "Try the new Meridian theme" from Classic cPanel Jupiter; you can switch back with "Classic cPanel Theme" at any time). The Security section reorganizes tools that exist in Classic too, under different names and a single score instead of separate tiles.
What the score actually checks
The Security tab shows the Security Score alongside SSL status and a Web Firewall status indicator. Each maps to a real setting:
- SSL status reflects whether a certificate is currently issued and valid for your domain, under the Automatic SSL tool. Flashcloud auto-issues a free Let's Encrypt certificate roughly 5 minutes after your domain's DNS points to us, and renews it automatically. If SSL shows as missing, the usual cause is DNS not pointing here yet, or a very recent domain change that hasn't propagated.
- Web Firewall is Imunify360 running as your account's WAF, covering your domains.
- HTTPS Redirect checks whether plain
http://requests get forced tohttps://. This is a per-domain setting under Websites & Apps → your site → Settings → Force HTTPS. It's a separate setting from SSL status, so a valid certificate doesn't guarantee redirect is on.
You'll also see these surface as action cards on the main Dashboard: "No Certificate → Fix SSL Issue" or "DNS not resolving → Check DNS" are the same underlying checks, presented earlier in the flow so you notice before drilling into Security.
The Protection tab
Inside Security, the Protection tab holds the controls that actually change your exposure, rather than only reporting on it:
- WAF - toggle and review the web firewall per domain. This is the same Imunify360 engine referenced above.
- IP Blocker - block specific IPs on your account. Useful as a companion to what Imunify360 catches automatically. For distributed attacks that don't come from one IP, our DDoS protection article covers what handles that layer instead.
- Hotlink Protection - prevents other sites from embedding your images directly.
None of these three change the Security Score directly, but leaving WAF off or ignoring a flagged IP is the kind of thing that eventually shows up as a problem elsewhere on the dashboard.
The Advanced tab
Advanced covers account access rather than site-facing protection:
- SSH keys - add or remove public keys for SSH access. If you connect by key instead of password, this is where you manage which keys are trusted. Meridian doesn't add an SSH client. You still need one on your end; the actual connection process is the same as in Classic cPanel.
- Active sessions - see what's currently logged into cPanel, including IP, time, and which one is your current session. Worth checking if you shared access temporarily, handed off a project, or want to confirm nothing's logged in from somewhere unexpected.
There's no two-factor authentication toggle here. 2FA for your account lives in the Flashcloud portal, not cPanel. See our portal walkthrough for where that setting sits alongside your password and contact details.
If a score problem won't clear
If you've fixed HTTPS redirect and enabled the WAF but the score still shows a problem, or if Active Sessions shows a login you don't recognize, open a ticket from the portal (Support). It goes to a real person, not a bot.