Emergency mode
The InfraFence "Under attack" button - 24 hours of automatic response with the AutoMode catalog, how many times each plan can use it, and how to stop it and undo what it did.
Last updated:
Under attack and no time to investigate? The red Under attack button in the top bar starts the emergency mode: for the next 24 hours InfraFence responds to the attack by itself, with the same safe catalog and limits as AutoMode.
What it may do
- ban the addresses that are attacking you;
- block countries the attack comes from;
- turn on extra protections: port-scan bans, threat lists, longer bans for repeat offenders;
- apply hardening fixes, and install urgent updates for flaws that are being exploited;
- run malware, software and hardening scans.
It never runs commands of its own and never locks you out: your own addresses, whitelisted ones and the places you log in from are never blocked. Servers in monitor mode are not touched; it only notes what it would do.
What is risky waits for a person, as with AutoMode: a fix that touches logins, an update of a critical package, closing a port nothing attacked. It goes to Approvals: see What needs your approval.
Approving needs two-factor authentication. Only an owner or admin signed in with two-factor authentication can approve, on the Pro or AutoMode plan. Turn it on under Settings › Security before an attack, not during one.
Who can use it, and how often
| Plan | Emergency mode |
|---|---|
| Starter | Not included: the button offers to upgrade, and the emergency starts as soon as the payment confirms the plan. |
| Basic, Pro | 2 every 30 days |
| AutoMode | Always on: AutoMode does this all the time, so the button is not shown. |
Only owners and admins can start it, and only one emergency runs at a time. The dialog shows Emergencies left in the last 30 days.
During and after
The top bar shows until when the emergency runs. Stop emergency mode ends it early: nothing new is applied, and what was already done stays.
Everything it did appears in Activity, filterable by emergency session, and each action can be undone there.