InfraFence documentation
How to install the InfraFence agent on Linux servers, configure it, and use every protection and dashboard feature, from the first command to AutoMode.
Last updated:
InfraFence protects Linux servers in two parts:
- The agent, a single static Go binary that runs on each server (x86-64 or ARM64). It reads the server's logs, DNS traffic, connections and files, detects attacks as they happen and blocks them at the firewall, in its own chains.
- The dashboard at infrafence.com, where you see every server live, change settings, review incidents and, on the paid plans, let the AI propose or apply fixes.
The agent keeps protecting the server when the dashboard cannot be reached. Settings you change in the dashboard reach your servers in about a second.
Where to start
- New to InfraFence? Follow the Quick start: one command, and the server shows up in the dashboard.
- Want to see what the installer would change first? Read What the installer does and run it with
--dry-run. - Running containers? See Docker and Kubernetes.
- Hosting provider? The hosting panels page covers the WHM plugin and the Plesk extension, and a real cPanel & WHM server shows them at work.
- Evaluating the security of the agent itself? Start from the security model.
What every plan includes
Every plan, Starter included, gets every detection layer: SSH and service brute force, the web firewall, bots, malware, file integrity, outbound and DNS threats, SSH session risk, hardening and vulnerability checks. Starter is free for one server. The paid plans add more servers, more alert channels, the InfraFence network, AI guidance and AutoMode: see Billing and plans.
Conventions in these pages
- Commands run on the server as root, or with
sudo. - Paths, flags, configuration keys and commands are written exactly as the agent uses them.
- Names in bold are labels you see in the dashboard.