Pricing
Pricing
Free tier includes 1 server with full protection. Paid plans are per server, with no server limit.
Starter
Full protection for one server.
$0Free
- 1 server
- Full protection and automatic blocking
- Instant analysis of every incident
- Security score with the top fixes
Basic
Every server protected, alerts everywhere.
$8.90/server/month
14 days of AutoMode free when you sign up, no card; then Starter unless you choose a plan. Cancel anytime.
- Unlimited servers
- Slack, Discord, Telegram and webhook alerts
- InfraFence network autoblock
- 90 days of event history
- Monthly value report
- cPanel & WHM plugin
Pro
The AI tells you what to do.
$18.90/server/month
14 days of AutoMode free when you sign up, no card; then Starter unless you choose a plan. Cancel anytime.
- Everything in Basic
- AI guidance on every incident: what happened and what to do
- One-click safe fixes proposed by the AI, virtual patches and port closing included
- Ask your server: the AI assistant, 200 questions a day
- NIS2 and GDPR report drafts
- AI analysis, 100 a day
AutoMode
The AI does it for you, all the time.
$28.90/server/month
14 days of AutoMode free when you sign up, no card; then Starter unless you choose a plan. Cancel anytime.
- Everything in Pro
- AutoMode: the AI applies safe fixes by itself, 24/7
- One-tap approval for anything risky
- Real-time InfraFence network bans
- Security updates in your maintenance window
- Every action logged, with Undo
- AI analysis 300 a day, assistant 500 a day
Prices in USD. Customers in the euro area are billed in EUR at the same amounts.
Compare plans
| Feature | Starter | Basic | Pro | AutoMode |
|---|---|---|---|---|
| Servers | 1 | Unlimited | Unlimited | Unlimited |
| Detection and automatic blocking (SSH, WAF, bots, malware, egress & DNS, file integrity) | ✓ | ✓ | ✓ | ✓ |
| Hardening checks and CVE scanning | ✓ | ✓ | ✓ | ✓ |
| Instant analysis of every incident | ✓ | ✓ | ✓ | ✓ |
| Security score per server and organization | ✓ | ✓ | ✓ | ✓ |
| Every change verified, rolled back by itself if something breaks | ✓ | ✓ | ✓ | ✓ |
| "Under attack" emergency mode (24 h) | — | 2 per 30 days | 2 per 30 days | Unlimited |
| Real-time dashboard, team members and two-factor authentication | ✓ | ✓ | ✓ | ✓ |
| Email alerts | ✓ | ✓ | ✓ | ✓ |
| Slack, Discord, Telegram and webhook alerts | — | ✓ | ✓ | ✓ |
| InfraFence network autoblock | — | ✓ | ✓ | ✓ |
| Event history | 30 days | 90 days | 90 days | 90 days |
| Monthly value report | — | ✓ | ✓ | ✓ |
| AI guidance with one-click safe fixes | — | — | 100 a day | 300 a day |
| Virtual patches, port closing and outbound blocks | — | — | One click | Automatic |
| Assistant "Ask your server" | — | — | 200 a day | 500 a day |
| NIS2 and GDPR report drafts | — | — | 20 a day | 20 a day |
| AutoMode: safe fixes applied automatically, with Undo | — | — | — | ✓ |
| One-tap approval for risky actions | — | — | — | ✓ |
| Real-time InfraFence network bans (when you share threat intel) | — | — | — | ✓ |
| cPanel & WHM and Plesk pluginscPanel & WHM: AvailablePlesk: In development | — | ✓ | ✓ | ✓ |
| Trust badge and public trust page | ✓ | ✓ | ✓ | ✓ |
| Agency branding on the trust page | — | — | ✓ | ✓ |
| Support | Community (GitHub) |
Frequently asked questions
Is the free plan really free?
Yes. One server, with full protection including automatic blocking, forever. No credit card. New accounts also get 14 days of AutoMode free first.
What counts as a server?
Each Linux server where the agent is installed. Paid plans bill the number of servers you protect, adjusted automatically when you add or remove one.
What is the difference between Pro and AutoMode?
With Pro the AI explains each incident and proposes safe fixes that you apply with one click. With AutoMode it applies them by itself, around the clock: only actions from a fixed catalog (bans, country blocks, hardening fixes, security updates in your maintenance window, port closing, outbound blocks, virtual patches), never on your own IPs or SSH logins, and every action can be undone. You can pause it at any time.
What does AutoMode do with a risky action?
It waits for you. Changes that could lock someone out, updates of critical packages and ports outside the safe list become an approval request: you approve or reject it with one tap in the dashboard, with two-factor authentication. Unanswered requests expire after 24 hours, and nothing runs in the meantime.
What if a change breaks something?
After every change the agent checks that SSH still accepts connections and that your monitored sites still answer without new errors. If they do not, it rolls the change back by itself and the activity shows why.
Are the NIS2 and GDPR reports ready to send?
No. They are drafts built from your servers' events, to review and complete before you send them yourself. They are not legal advice, and InfraFence never decides whether an incident must be reported.
How does the trial work?
Every new account gets 14 days of AutoMode free, with no card, starting when you confirm your email address. We email you 7, 3 and 1 day before it ends. Then the organization moves to Starter unless you choose a plan: the server connected first stays protected and the others are paused (their data stays visible) until you choose one. Choosing a paid plan during the 14 days ends the free period and billing starts at once: there is no second trial at checkout. Sign up with a permanent email address: temporary inboxes can't create an account.
Can I change plan or cancel anytime?
Yes, from Settings → Plan & billing. A change between paid plans takes effect at once, with the difference prorated. After a cancellation the plan stays active until the end of the paid period, then the organization goes back to Starter.
Do you issue invoices with VAT?
Yes. Invoices come from Stripe; you can add your VAT number at checkout.
What data leaves my server?
Only security events: attacker IP, type, time and the details needed to understand them. Full logs and files never leave your server. The agent's source is public (BSL 1.1).
Do the cPanel & WHM and Plesk plugins cost extra?
No. They are included in Basic, Pro and AutoMode at no extra cost: you pay per server as usual. Starter does not include them. If payment stops, the plugin shows no data from the 72-hour stop until the plan is active again. The WHM plugin is available from your dashboard; the Plesk extension is in development.
Pro and AutoMode: security that acts, safely
Finding the problem is half the job. With Pro the AI tells you what to do and you apply it with one click; with AutoMode it does it for you. Always within strict limits, and always with a way back.
Approvals need two-factor authentication: only an owner or admin signed in with a code from an authenticator app can approve or reject, so turn it on before you rely on AutoMode.
Only safe, known actions
AutoModeAutoMode picks from a fixed catalog: bans, country blocks, hardening fixes (PHP's allow_url_include, display_errors and expose_php among them), security updates in your maintenance window, port closing, outbound blocks, virtual patches and scans. It never runs commands of its own, never blocks your own addresses or the places you log in from, leaves servers in monitor mode alone, and one switch pauses it.
One-tap approval for anything risky
AutoModeA change that could lock someone out, an update of a critical package, a port outside the safe list: AutoMode does not do it on its own. It asks you, and you approve or reject with one tap in the dashboard, signed in with two-factor authentication. The link in the alert only opens the request, so a forwarded message cannot approve anything. Requests nobody answers expire after 24 hours.
Checked after every change, undone if it breaks
All plansAfter every change to a server (a firewall rule, a hardening fix, a virtual patch) the agent checks that SSH still accepts connections on every port it uses and that every monitored site still answers, with no new errors. If not, it rolls the change back by itself and tells you why.
Virtual patches for exploited vulnerabilities
Pro · AutoModeWhen a server runs software with a vulnerability that is being exploited in the wild, a targeted ModSecurity rule can shield it until you install the update. In this release: Apache with ModSecurity. The configuration is tested before the reload and rolled back if anything fails.
Close exposed ports, block bad destinations
Pro · AutoModeA database or admin service (MySQL, PostgreSQL, Redis, MongoDB, Elasticsearch, the Docker API…) open to the internet and under attack gets its port closed. A server talking to a known malicious address gets that destination blocked. SSH ports are never closed, nor 80/443 while a web server uses them, nor a port with a live connection. Each one can be undone.
The InfraFence network, in real time
AutoModeWhen two different AutoMode organizations that share threat intelligence ban the same address within an hour, each with strong evidence, every AutoMode organization that shares blocks it too, for 6 hours. It never touches your allowlist, your never-block list or the networks you log in from.
Ask your server
Pro · AutoModeAsk in plain words: who tried to log in last night, why an address was banned, what happened on a server this week. The assistant reads your events, bans, incidents, SSH sessions, scans and AutoMode actions (read-only) and can suggest a fix you apply with one click. 200 questions a day with Pro, 500 with AutoMode.
NIS2 and GDPR report drafts
Pro · AutoModeFrom an incident or a time range, InfraFence drafts the NIS2 early warning (24 h), incident notification (72 h) and final report, and the GDPR Article 33 breach assessment, in your language, with a timeline built from the events. They are drafts for you to review and complete, not legal advice, and nothing is sent to any authority.
How NIS2 reporting worksSecurity score
All plansA score from 0 to 100 for each server and for the organization: hardening results, open vulnerabilities (exploited ones weigh most), risky open ports, malware, monitor mode, agent version and two-factor authentication. With its trend and the top 3 fixes. Every plan sees it; applying the fixes with one click is Pro.
Monthly value report
Paid plansOn the first day of each month, by email and in the dashboard: attacks blocked, bans, fixes applied, AutoMode actions and approvals, how the score moved, and an estimate of the hours saved, with how it is calculated.
Under attack? One red button.
Press "Under attack" in the dashboard and for the next 24 hours the AI responds to the attack by itself, with the same safe catalog and the same limits: it bans the attackers, turns on extra protections, applies safe fixes and urgent updates for exploited flaws. Everything appears in the activity, with Undo. Twice every 30 days on Basic and Pro, whenever you need it with AutoMode.
Security & trust
Running this agent means granting it privileged access to your server — that's a real ask, and we don't take it lightly. Here's exactly what backs that trust in production:
- Source-available & auditable
- The agent is licensed under BSL 1.1. It is 100% free for internal production use, completely transparent, and you can audit every line before installing.
- Checks before it changes
- A read-only scan of the server runs before installation and every day. Web server changes and threat-list blocking stay off until you turn them on, and never happen where a hosting panel manages the configuration.
- What it reads
- To detect threats it reads system and web server logs, website files for the malware scan (including .env and configuration files), WordPress posts and users for the WordPress scan, and the server's DNS traffic and network connections.
- What it sends
- Security events only: attacker IP, type, time and the details needed to understand them — for a web attack the single log line that triggered it, for malware the file path and the matched text. Full logs and files never leave your server. No telemetry. Nothing is shared with third parties, except for the AI features: when you ask for an analysis, use the assistant or draft a report, and while AutoMode or emergency mode is on, the events needed are sent to Anthropic to produce the answer.
- Dedicated firewall chain
- All its rules live in its own INFRAFENCE chains, repaired automatically if another tool removes them. Your existing rules are never modified.
- Signed binaries
- Every release is built by GitHub Actions CI with Cosign signatures and build provenance attestation.
- Monitor mode
- Detect everything, block nothing — enable protection when you're ready.
- Clean uninstall
- One command removes the agent and everything it added: firewall chains, web server changes and the service.