InfraFenceInfraFence

Live Security Operations

Get Started

Stop the attack. Fix what let it in.

InfraFence blocks attacks on your Linux servers as they happen, inbound and outbound. Then it hardens, patches and checks the result, and undoes any fix that breaks something.

One command to install, one live dashboard for every server. 14 days of AutoMode free when you sign up, no card; then free for one server, forever.

Get Started FreeView on GitHub

Attacks seen by the InfraFence network and our sensors in the last 24 hours

Counted per country: no addresses, no customer data. Network figures only where 3 or more organizations contributed.

Built to run on production servers

What it reads and what it sends
Source-available
Licensed BSL 1.1: audit every line of the agent before you install it.
Signed releases
Built in CI with Cosign signatures and build provenance.
Checks before it changes
A read-only scan of the server runs before installing, and every day after.
Clean uninstall
One command removes the agent and everything it added.

Tested on these Linux distributions

Every release is tested automatically on each of them, on x86-64 and ARM64 servers: real installation, an SSH brute-force attack, detection, the firewall ban, the attacker actually blocked, and a clean uninstall.

  • Ubuntu

    20.04 · 22.04 · 24.04 · 26.04

  • Debian

    12 · 13

  • Rocky Linux

    8 · 9

  • AlmaLinux

    8 · 9

  • CentOS Stream

    9

  • Oracle Linux

    9

  • Fedora

    41 · 42

  • Amazon Linux

    2023

Other Debian- or RHEL-based distributions usually work too, but we only list the ones we test. Names and logos belong to their owners.

Why InfraFence

InfraFence watches both directions: what comes into the server and what leaves it. It knows who was logged in when something happened, and it fixes what it finds without taking production down.

  1. Example

    DNSq7f3a9c1e2.sync.example

    DNSx0b8d4k2m9.sync.example

    DNSp5t1v7w3r8.sync.example

    DNS…

    Possible DNS tunnel

    php-fpm · pid 4112 · www-data

    01

    Catches a server that is already compromised

    Inbound filters can't see a machine that is already calling home. InfraFence ties every DNS query to the program that made it, and flags connections to known-bad addresses.

    Detects DNS tunnels and random-domain malware (DGA) with the process, pid and user, and connections to known malicious addresses.

    How it works: Catches a server that is already compromised
  2. Example

    deploy@203.0.113.24Session risk

    1. Login with a key12
    2. sudo28
    3. Web shell blocked by the WAF71
    4. /etc/crontab changed94

    02

    Knows who was logged in when it happened

    Every SSH session is scored from 0 to 100, and the score jumps when anything suspicious happens while it is open. Many weak signals become one alert about one person.

    Six detectors feed the score: web firewall, file integrity, malware, port scans, outbound traffic and DNS.

    How it works: Knows who was logged in when it happened
  3. Example

    Hardening fix: SSH password login off

    • SSH answers on port 22
    • example.com answers, no new errors

    Change kept

    If a check fails: rolled back by itself, with the reason

    03

    Fixes that can't take production down

    Whether you apply a fix or AutoMode does, the agent then checks that SSH and your sites still answer, and rolls the change back by itself if they don't.

    Checked after every change: SSH on every port it uses, every monitored site over HTTP and HTTPS. Included in every plan.

    How it works: Fixes that can't take production down
  4. Catalogue
    • Bans
    • Country blocks
    • Hardening fixes
    • Security updates
    • Port closing
    • Outbound blocks
    • Virtual patches
    • Scans

    Risky changes wait for your approval

    Never commands of its own

    04

    AI that acts only inside fixed limits

    AutoMode responds around the clock, but only with actions from a fixed catalogue. Anything risky waits for your one-tap approval, and every action can be undone.

    Eight kinds of action and nothing else. It never runs commands of its own and never blocks your own addresses or SSH logins.

    How it works: AI that acts only inside fixed limits

What it detects

Every plan, Starter included, gets every layer below. Each one works on its own, with safe defaults.

Protected in three steps

  1. 01

    Install

    Run one command as root on any Linux server, x86-64 or ARM64. A read-only check runs first, and nothing that could conflict is changed.

  2. 02

    Connect

    The agent registers with your single-use token and gets its own credentials. The server appears in your dashboard.

  3. 03

    Protected

    Attacks are blocked from the first minute. Prefer to watch first? Monitor mode detects everything and blocks nothing until you are ready.

Works inside cPanel & WHM and Plesk

cPanel & WHM: AvailablePlesk: In development

For hosting companies, agencies and MSPs. Bans, malware findings, security events and per-site scans in the panel your team already uses, on every server. No credentials stored in the panel, included in Basic, Pro and AutoMode.

InfraFence for hosting providers

cPanel & WHM

Available

WHM » Plugins » InfraFence

RPM for AlmaLinux 8, 9, 10 and CloudLinux · .deb for Ubuntu 24.04

Plesk

In development

Plesk Obsidian 18.0.60 or later, in the left navigation

Extension zip, installed with the Plesk extension manager

Priced per server, free to start

Full protection is free on one server. Paid plans add unlimited servers, alerts everywhere, AI guidance and AutoMode.

Compare all plans

  • Starter

    Free

    Full protection for one server.

  • Basic

    $8.90/server/month

    Every server protected, alerts everywhere.

  • Pro

    $18.90/server/month

    The AI tells you what to do.

  • AutoMode

    $28.90/server/month

    The AI does it for you, all the time.

14 days of AutoMode free when you sign up, no card; then Starter unless you choose a plan. Cancel anytime. Prices in USD. Customers in the euro area are billed in EUR at the same amounts.

Questions before you install

Will it break my server or fight my firewall?

No. A read-only check runs before anything is installed. Every rule lives in InfraFence's own firewall chains, your existing rules are never modified, and a configuration managed by a hosting panel is never edited. One command uninstalls everything it added.

What data leaves my server?

Only security events: attacker IP, type, time and the details needed to understand them. Full logs and files never leave your server, and there is no telemetry. The agent's source is public (BSL 1.1).

What if a change breaks something?

After every change the agent checks that SSH still accepts connections and that your monitored sites still answer without new errors. If they don't, it rolls the change back by itself and the activity shows why.

What is the difference between Pro and AutoMode?

With Pro the AI explains each incident and proposes safe fixes you apply with one click. With AutoMode it applies them by itself, around the clock, from a fixed catalogue; it asks before anything risky, and every action can be undone.

Which systems does it run on?

Linux on x86-64 and ARM64. Every release is tested on Ubuntu, Debian, Rocky Linux, AlmaLinux, CentOS Stream, Oracle Linux, Fedora and Amazon Linux. It protects Docker containers, and a Helm chart covers every Kubernetes node.

Is the free plan really free?

Yes. One server with full protection, automatic blocking included, forever. No credit card. New accounts also get 14 days of AutoMode free first.

Protect your first server with one command

Free for one server with full protection, forever. Every new account starts with 14 days of AutoMode free, no card.

Get Started FreeSee pricing