Everything InfraFence detects and blocks
Every layer of detection and response, on every plan, and what Pro and AutoMode add on top. Open the technical details for the exact patterns, files and checks.
SSH & brute force
Password guessing stops at the firewall, and repeat attackers stay out longer each time.
Brute-force attempts are spotted in the SSH log as they happen, and the address is banned at the firewall. Each new offence bans it for longer, or for the duration you choose.
Technical details
- 15 patterns: failed passwords, invalid users, PAM failures, pre-auth scanning, protocol mismatches and key-exchange drops
- Escalating bans: 24 hours, 7 days, 30 days, then permanent, or a duration you set
- Brute-force detection for Postfix, Dovecot, MySQL, PostgreSQL, MongoDB, Pure-FTPd, ProFTPD and vsftpd
- Optional: an address banned on one server is banned on all your servers
Web Application Firewall
Each visitor gets a risk score: attackers are slowed down, then blocked, then banned.
Each detection adds points to the visitor's score, which decays by 5 points per minute. Action levels: observe (30) → slow down (60) → block (80) → firewall ban (100). From the dashboard you can see every built-in rule, change weights, thresholds and per-type mode, turn off single patterns and add your own rules.
| Attack type | Score | Mode |
|---|---|---|
| RCE / Web shell / Shellshock | +50 | Score-based |
| Scanner UA (sqlmap, nikto, nmap, nuclei…) | +50 | Score-based |
| SQL injection / SSRF / Web exploit | +40 | Score-based |
| Honeypot trap (decoy paths you define) | +40 | Score-based |
| Path traversal / Header injection | +30 | Score-based |
| WordPress brute force | +30 | Threshold (10 req / 2 min) |
| XSS / .env probe / XMLRPC | +25 | Score-based |
| Config probing | +20 | Score-based |
| 404 flood | +15 | Threshold (15 req / 5 min) |
Bot management
Search engines get in; scrapers and fake crawlers don't. You decide, bot by bot.
About 1,500 bots are recognized from public lists updated every day. For each category, or each single bot, you choose: allow, log only or block.
Technical details
- Categories: search engines, AI crawlers, SEO tools, scanners, monitoring, link previews and more
- Bots that claim to be a search engine are checked against their address, and fakes are unmasked
- Every bot comes with a plain-language explanation
Malware scanner
Finds web shells, backdoors and crypto miners, and tells you exactly why.
Your sites and the system are scanned on a schedule and on demand. Every finding says why it matched, how severe it is and which file it is, with its SHA-256.
Technical details
- Signature scanning — 28 built-in patterns for web shells, backdoors, crypto miners and phishing kits
- YARA engine — community rules for web threats, refreshed daily (needs the yara tool, installable with one click from the dashboard)
- Every finding explains why it matched, how severe it is and the file's SHA-256, with links to check it on public malware databases
- Framework detection — WordPress, Laravel, Django, Symfony, CakePHP, CodeIgniter, Node/Express, Rails, Joomla, Drupal
- Framework security checks — .env exposure, DEBUG mode, APP_KEY, loose permissions, Telescope, wp-config
- Heuristics — Shannon entropy detection, timestamp anomalies in upload directories
- System integrity — modified system binaries (dpkg -V / rpm -Va), rootkit indicators
- Credential scan — exposed .env files, SSH key permissions, .git in the web root, cloud credentials
- WordPress database scan — injected scripts in posts and options, rogue admin users
- Process detection — running crypto miners, reverse shells, suspicious scripts from /tmp
- Quarantine — one click moves a malicious file to quarantine, from where it can be restored
- Ignore — mark a false positive once and future scans skip it
- Scheduled scans every 3, 6, 12 or 24 hours, plus "Scan now" from the dashboard
- Real-time watcher — checks upload directories every 30 seconds for new PHP files
- False-positive prevention — WordPress core checksums, context-based severity
ModSecurity inline WAF (optional)
Stops web attacks on the very first request, before they reach your application.
An optional inline layer for Apache with mod_security2. It stays off until you allow web server changes, and never touches a server whose configuration a hosting panel manages.
Technical details
- Only when you allow web server changes in Settings — off by default
- Never on servers whose configuration is managed by a hosting panel or a configuration-management tool
- For Apache with mod_security2
- 13 rules — SQL injection, XSS, RCE, SSRF, path traversal, Shellshock, Log4Shell, Spring4Shell, scanner blocking
- Blocks on the first request, before traffic reaches your application
- Safe: if Apache's configuration test fails, the change is rolled back
- Active bans are enforced by ModSecurity too, for visitors behind a proxy or CDN
File integrity & persistence monitoring
Know the moment a system file changes or someone plants a way back in.
Critical files are hashed once and watched from then on. Any change raises an alert at once, including the places attackers use to keep access after a reboot.
Technical details
- Core system files — /etc/passwd, /etc/shadow, /etc/group, /etc/sudoers (+ sudoers.d/*), /etc/ssh/sshd_config, /etc/hosts, /etc/resolv.conf
- Scheduled-task persistence — /etc/crontab, /etc/cron.d/*, and per-user crontabs
- SSH persistence — authorized_keys for root and every user under /home/*
- Rootkit / hijack points — /etc/ld.so.preload (classic userspace LD_PRELOAD hijack)
- Systemd persistence — /etc/systemd/system/*.service and *.timer
Outbound and DNS threat detection
Spots a compromised server talking to its controllers.
InfraFence watches what the server sends out as closely as what comes in. That is how a machine that is already compromised gets caught.
Technical details
- Outbound connections to IPs on public threat-intelligence lists
- DNS inspection — every DNS query is read (without changing anything) and tied to the program that made it: queries to unexpected or malicious DNS servers, domains that resolve to known malicious IPs, DNS tunnels, and malware generating random domains (DGA)
- The server's own DNS service and antivirus or anti-spam lookups are recognized and not reported
SSH session risk scoring
Turns scattered alerts into one clear alert about the person who was logged in.
Every SSH session is followed from login to logout and scored from 0 to 100. If another detector fires while the session is open, its score jumps, so you know who was on the server when it happened.
Technical details
- What is scored: authentication method, reputation of the source address, login hour and privileged commands (sudo, useradd, passwd, crontab, su)
- Sigma correlation: the web firewall, file integrity, malware, port scan, outbound and DNS detectors raise the score of every open session
- Each session gets its final score when it closes
Hardening, vulnerabilities and security score
Shows how exposed each server is, what to fix first and how.
Beyond attacks, InfraFence checks the server itself every day, or when you ask: settings, exposed services, outdated packages. It tells you what to fix first.
Technical details
- 40–50 hardening checks, depending on the server — SSH settings, permissions of sensitive files, databases open to the internet, accounts, web server settings, exposed secrets, outdated software
- One-click fixes for the safe ones: each change goes in a file of its own, is tested before the service is reloaded and can be undone. Changes that could lock you out or break a site are explained step by step instead
- Known vulnerabilities (CVE) of the installed packages, from the Debian, Ubuntu, AlmaLinux and Rocky Linux security trackers — what an update fixes now, apart from what has no fix yet
- A security score from 0 to 100, showing what lowers it
PHP hardening
Finds risky PHP settings in every runtime and pool, and fixes the safe ones.
InfraFence reads the effective configuration of every PHP version on the server and of each PHP-FPM pool, and reports risky settings with the file and line they come from. It watches those files and alerts you when a dangerous value appears. This is configuration hardening and watching: nothing is loaded into PHP, and it is not a protection running inside your applications.
Technical details
- PHP from the distribution, ondrej, remi, cPanel EA4, Plesk and CloudLinux alt-php, with every PHP-FPM pool and the sites behind it
- Checked per runtime and pool: allow_url_include, display_errors, expose_php, cgi.fix_pathinfo, disable_functions, open_basedir on shared pools, session cookie flags and allow_url_fopen
- Real-time watching: an alert when allow_url_include or display_errors is turned on, naming the file
- One-click fixes for allow_url_include, display_errors and expose_php, which AutoMode can also apply by itself; cgi.fix_pathinfo and disable_functions only with your approval, showing the site files that would be affected; open_basedir and values a pool sets in its own file come with the exact line to change by hand
- Each fix goes in a drop-in file of InfraFence's own, is tested with php-fpm -t, reloaded gracefully (never restarted) and rolled back if a site stops answering
- On cPanel, Plesk and CloudLinux the PHP configuration is reported, never changed
And more
- Mail, database and FTP protection — brute force detection for Postfix, Dovecot, MySQL, PostgreSQL, MongoDB, Pure-FTPd, ProFTPD and vsftpd
- Docker-aware — finds web containers' logs and protects published container ports
- Country blocking from the dashboard
- Hosting panels recognized — cPanel/WHM, Plesk, DirectAdmin, CyberPanel, HestiaCP, Coolify, Easypanel and 17 more; InfraFence never edits a configuration a panel manages
- LiteSpeed and OpenLiteSpeed recognized
- Dashboard changes reach your servers in about a second
- Monitor mode — detect everything, block nothing
- System metrics — CPU, memory, disk and network
- Every event explained in plain language, in 6 languages
- Optional: an address banned on one server is banned on all your servers
- Kubernetes — Helm chart DaemonSet: one cluster key registers every node, each node shows up as its own server; updates use cosign-signed images
- Vulnerabilities in order of real risk: exploited in the wild (CISA KEV) first, then exploit probability (EPSS)
- Instant analysis of every incident — likely cause, risk and what to do now, free and computed in the dashboard; an AI deep dive on demand
- Optional InfraFence network — addresses that attack several customers are flagged, and unusual SSH logins (new account, new country) stand out
- Alerts by email, Slack, Discord, Telegram or webhook, plus a weekly summary email
- Two-factor authentication and an activity log of who changed what
Pro and AutoMode: security that acts, safely
Finding the problem is half the job. With Pro the AI tells you what to do and you apply it with one click; with AutoMode it does it for you. Always within strict limits, and always with a way back.
Approvals need two-factor authentication: only an owner or admin signed in with a code from an authenticator app can approve or reject, so turn it on before you rely on AutoMode.
Only safe, known actions
AutoModeAutoMode picks from a fixed catalog: bans, country blocks, hardening fixes (PHP's allow_url_include, display_errors and expose_php among them), security updates in your maintenance window, port closing, outbound blocks, virtual patches and scans. It never runs commands of its own, never blocks your own addresses or the places you log in from, leaves servers in monitor mode alone, and one switch pauses it.
One-tap approval for anything risky
AutoModeA change that could lock someone out, an update of a critical package, a port outside the safe list: AutoMode does not do it on its own. It asks you, and you approve or reject with one tap in the dashboard, signed in with two-factor authentication. The link in the alert only opens the request, so a forwarded message cannot approve anything. Requests nobody answers expire after 24 hours.
Checked after every change, undone if it breaks
All plansAfter every change to a server (a firewall rule, a hardening fix, a virtual patch) the agent checks that SSH still accepts connections on every port it uses and that every monitored site still answers, with no new errors. If not, it rolls the change back by itself and tells you why.
Virtual patches for exploited vulnerabilities
Pro · AutoModeWhen a server runs software with a vulnerability that is being exploited in the wild, a targeted ModSecurity rule can shield it until you install the update. In this release: Apache with ModSecurity. The configuration is tested before the reload and rolled back if anything fails.
Close exposed ports, block bad destinations
Pro · AutoModeA database or admin service (MySQL, PostgreSQL, Redis, MongoDB, Elasticsearch, the Docker API…) open to the internet and under attack gets its port closed. A server talking to a known malicious address gets that destination blocked. SSH ports are never closed, nor 80/443 while a web server uses them, nor a port with a live connection. Each one can be undone.
The InfraFence network, in real time
AutoModeWhen two different AutoMode organizations that share threat intelligence ban the same address within an hour, each with strong evidence, every AutoMode organization that shares blocks it too, for 6 hours. It never touches your allowlist, your never-block list or the networks you log in from.
Ask your server
Pro · AutoModeAsk in plain words: who tried to log in last night, why an address was banned, what happened on a server this week. The assistant reads your events, bans, incidents, SSH sessions, scans and AutoMode actions (read-only) and can suggest a fix you apply with one click. 200 questions a day with Pro, 500 with AutoMode.
NIS2 and GDPR report drafts
Pro · AutoModeFrom an incident or a time range, InfraFence drafts the NIS2 early warning (24 h), incident notification (72 h) and final report, and the GDPR Article 33 breach assessment, in your language, with a timeline built from the events. They are drafts for you to review and complete, not legal advice, and nothing is sent to any authority.
How NIS2 reporting worksSecurity score
All plansA score from 0 to 100 for each server and for the organization: hardening results, open vulnerabilities (exploited ones weigh most), risky open ports, malware, monitor mode, agent version and two-factor authentication. With its trend and the top 3 fixes. Every plan sees it; applying the fixes with one click is Pro.
Monthly value report
Paid plansOn the first day of each month, by email and in the dashboard: attacks blocked, bans, fixes applied, AutoMode actions and approvals, how the score moved, and an estimate of the hours saved, with how it is calculated.
Under attack? One red button.
Press "Under attack" in the dashboard and for the next 24 hours the AI responds to the attack by itself, with the same safe catalog and the same limits: it bans the attackers, turns on extra protections, applies safe fixes and urgent updates for exploited flaws. Everything appears in the activity, with Undo. Twice every 30 days on Basic and Pro, whenever you need it with AutoMode.
Hosting panels
cPanel & WHM: AvailablePlesk: In developmentFor hosting companies, agencies and MSPs. Bans, malware findings, security events and per-site scans in the panel your team already uses, on every server. No credentials stored in the panel, included in Basic, Pro and AutoMode.
- Protection status, security score, critical events and the attack map
- Banned addresses: unban on this server only, or add to the whitelist
- Malware and file-integrity findings, recent security events
- Coexistence with CSF/lfd, Imunify360, cPHulk, fail2ban, CrowdSec, Plesk Firewall and more
- Sites and domains with malware-scan coverage, and Scan now for one site
- No credentials in the panel; root and administrator only
cPanel & WHM
AvailableWHM » Plugins » InfraFence
RPM for AlmaLinux 8, 9, 10 and CloudLinux · .deb for Ubuntu 24.04
Plesk
In developmentPlesk Obsidian 18.0.60 or later, in the left navigation
Extension zip, installed with the Plesk extension manager
Show your clients they are protected
Put the “Monitored by InfraFence” badge on your website. It links to a public trust page on infrafence.com with the time of the last check, the attacks blocked in the last 30 days and the protections active.
- An image inside a link: no script and no cookies on your site.
- Never shows addresses, findings or scores, and turns a neutral grey when a check is overdue.
- Proof of monitoring for your clients and for supplier questionnaires such as NIS2.
What you get
| InfraFence | |
|---|---|
| Live dashboard for all your servers | Yes, updated in real time |
| Install | One command, with a read-only check first |
| SSH brute force | 15 patterns, escalating bans |
| SSH session risk scoring | Yes, correlated with every other detector |
| Web application firewall | 15 attack types, editable from the dashboard |
| Bots | ~1,500 recognized; allow, log or block per category or bot |
| Malware | Signatures + YARA, with quarantine and ignore |
| File integrity & persistence | System-wide |
| Outbound & DNS threats | DNS inspected packet by packet, tied to the program |
| Docker | Yes: container logs and published ports |
| Kubernetes | Helm DaemonSet, one server per node |
| Alerts | Email, Slack, Discord, Telegram, webhooks |
| Incident analysis | Instant and free, AI on demand |
| Monitor mode (detect only) | Yes |
| Fixes applied for you | AutoMode: fixed catalog, approvals, verified, with Undo |
| Exploited vulnerabilities | Virtual patches until you update (Apache + ModSecurity) |
| Incident reports | NIS2 and GDPR drafts to review |
| Uninstall | Removes everything it added |
| Price | $8.90/server/month, 1 server free |
Security & trust
Running this agent means granting it privileged access to your server — that's a real ask, and we don't take it lightly. Here's exactly what backs that trust in production:
- Source-available & auditable
- The agent is licensed under BSL 1.1. It is 100% free for internal production use, completely transparent, and you can audit every line before installing.
- Checks before it changes
- A read-only scan of the server runs before installation and every day. Web server changes and threat-list blocking stay off until you turn them on, and never happen where a hosting panel manages the configuration.
- What it reads
- To detect threats it reads system and web server logs, website files for the malware scan (including .env and configuration files), WordPress posts and users for the WordPress scan, and the server's DNS traffic and network connections.
- What it sends
- Security events only: attacker IP, type, time and the details needed to understand them — for a web attack the single log line that triggered it, for malware the file path and the matched text. Full logs and files never leave your server. No telemetry. Nothing is shared with third parties, except for the AI features: when you ask for an analysis, use the assistant or draft a report, and while AutoMode or emergency mode is on, the events needed are sent to Anthropic to produce the answer.
- Dedicated firewall chain
- All its rules live in its own INFRAFENCE chains, repaired automatically if another tool removes them. Your existing rules are never modified.
- Signed binaries
- Every release is built by GitHub Actions CI with Cosign signatures and build provenance attestation.
- Monitor mode
- Detect everything, block nothing — enable protection when you're ready.
- Clean uninstall
- One command removes the agent and everything it added: firewall chains, web server changes and the service.