Automatic DDoS protection
for DirectAdmin users

Back to Blog

What the Plugin Does

The Flowtriq DirectAdmin plugin hooks into user lifecycle events. When you create a new user account in DirectAdmin, the plugin calls the Flowtriq API to provision a monitoring node for that user's primary IP. When you suspend, unsuspend, or destroy the account, the plugin updates the node to match.

You can control which DirectAdmin packages get auto-provisioning. A shared hosting package might not need per-user DDoS monitoring, but a VPS reseller package probably does.

Prerequisites

• DirectAdmin 1.60 or later
• PHP 7.4+ with curl and json extensions
• A Flowtriq account with API access enabled
• An API deploy token from your Flowtriq dashboard (Settings > API)

Installation

Clone the plugin from GitHub and run the installer:

cd /usr/local/directadmin/plugins
git clone https://github.com/Flowtriq/flowtriq-directadmin.git flowtriq
cd flowtriq
chmod +x install.sh
./install.sh

The install script registers the plugin with DirectAdmin, sets up the hook scripts, and creates the configuration directory. After it finishes, the plugin appears in the DirectAdmin admin panel under Extra Features > Flowtriq.

Configure Settings

Log into your DirectAdmin admin panel and go to Flowtriq > Settings. Fill in:

• API URL: https://flowtriq.com/api (or your white-label domain)
• Deploy Token: The API token from your Flowtriq dashboard
• Default Workspace: Which Flowtriq workspace new nodes should be created in
• Auto-Provision: Enable or disable automatic provisioning globally

Click Save. The plugin tests the API connection and confirms it worked.

Per-Package Control

Not every hosting package needs DDoS monitoring. Go to Flowtriq > Packages to see a list of all your DirectAdmin packages. Toggle auto-provisioning on or off for each one.

For example, you might enable it for "VPS Pro" and "Dedicated" packages but leave it off for "Starter Shared." Users on disabled packages do not get a Flowtriq node created when their account is set up.

What Admins See

The admin panel shows a network dashboard under Flowtriq > Dashboard with:

• All provisioned users: A table listing every user with a Flowtriq node, their IP, node status, and last check-in time
• Active incidents: Any ongoing DDoS attacks across all monitored users
• Fleet health: How many agents are online vs. offline

You can click into any user to see their full incident history and current traffic metrics.

What Users See

Users see a "DDoS Protection" link in their DirectAdmin panel under Extra Features. The user-facing page shows:

• Protection status: Whether their ftagent is running and reporting
• Recent incidents: Past attacks with type, duration, and peak traffic
• Install guide: The curl one-liner with their deploy token pre-filled, ready to paste into their server's terminal

curl -sSL https://flowtriq.com/install.sh | sudo bash

Users do not need a separate Flowtriq account. Everything stays inside DirectAdmin.

Hook Lifecycle

The plugin registers hooks for four DirectAdmin events:

• User Create: Provisions a Flowtriq node for the new user's primary IP. Stores the node ID and deploy token.
• User Suspend: Pauses monitoring on the Flowtriq node. No alerts fire while suspended.
• User Unsuspend: Resumes monitoring. The agent reconnects and traffic data flows again.
• User Destroy: Deletes the Flowtriq node and removes stored credentials.

All API calls are logged to /usr/local/directadmin/plugins/flowtriq/logs/. If a call fails, the plugin retries on the next cron cycle and logs the error.

Back to Blog

Related