SecFleet
Security for the Linux servers you run yourself
SecFleet watches your Linux server, stops the people trying to break in, and tells you in plain words what happened and what to do. No security degree needed.
Click an orange dot before it reaches the ring to block it yourself.
Every request to your website leaves a line in its log. SecFleet reads those lines as they arrive and knows the ones that are trying to break in.
Try:
Type a path on the left, or pick one of the examples.
Bots scan every address on the internet, all day. They do not pick you; they find you. On one real server we watched for a day, half of everything that arrived was someone trying to break in.
It sends spam, hides a card skimmer or points visitors to scams, and Google, your host or your client notices before you do.
A crypto miner eats the processor you pay for. A backdoor waits for the next time it is needed.
Nobody tested it, so you find out on the worst day of the year.
ALERT: anomalous auth activity detected (sev 3)"Someone tried 2,400 passwords on your server from one address. SecFleet blocked it. Allow sign-in with keys only? One click."Stopping attacks is the start. SecFleet looks after the whole machine, finds what is weak, and fixes it with you. Try it on a pretend server:
Each fix shows exactly what it will change on the server first, and can be undone.
Password guessing, scans for secrets and exploit attempts, read from your web server's logs and blocked.
Web shells, new admin accounts, sign-ins from places you have never been, programs set to start by themselves.
Nightly scans. Anything found goes to quarantine, never deleted on a guess, and comes back with one click.
Your installed software checked against the flaws attackers are using right now, with the update that closes them.
A full audit of how the machine is set up, and the fixes SecFleet can make for you, each with an undo.
Encrypted on the server, kept in a storage bucket you own, and a restore tested every week.
Disk filling up, memory running out, a service that stopped, a certificate about to expire.
An attacker one server sees is blocked on all of them. A team with roles, and a report you can hand a client or an insurer.
What SecFleet does while you sleep, and what you read over coffee.
One address tries 2,400 passwords on the WordPress sign-in page.
Blocked for a day, and added to the list your other servers block too.
A file called wp-cache.php appears in an uploads folder.
Looks like a web shell: it runs whatever a visitor sends it. One message to your phone.
The nightly checks run.
Backup made and tested. Disk at 61%. One security update waiting for openssl.
You open SecFleet.
One tap: the file goes to quarantine, where it can do nothing, and can come back if it was yours.
Good morning. Here is your night.
One small program, written in Python with nothing else to download, and a few system services. It reads your web server's logs, checks how the machine is set up, and reports to SecFleet over HTTPS. sudo secfleet uninstall removes it and lifts every block it placed.
It needs root to block addresses and fix settings, so it is built for that. The part that talks to the internet runs as its own unprivileged user. Every change is shown before it is made and can be undone. Updates are signed, and the installer checks the signature. The agent's code is being published so anyone can read it.
A summary: how many requests arrived, the addresses that attacked and what they tried, and the results of the checks. Not your site's files, not your database, not your visitors' pages. Backups go to storage you own, encrypted with a key that stays with you.
No. Any website behind nginx on Ubuntu 22.04 or newer, or Debian 12 or newer. WordPress sites get extra checks. Caddy and other web servers are next.
Not by surprise. Every server starts in practice mode: SecFleet writes down who it would block and blocks nobody. You look at the list, and turn blocking on when it looks right. Addresses you trust are never blocked.
Your first server is free. Paid plans are per server, priced for people who run a few rather than a few thousand. The first people on the list get a founding price that does not go up.
The first people on the list get in first, and get a founding price that does not go up.
secfleet uninstall