Protection against password guessing
Anyone trying to guess passwords on your server gets blocked within minutes
nuDefend reads your server’s login logs, identifies addresses making repeated password-guessing attempts, and blocks them at the firewall. It protects SSH, email, FTP, and your website’s login pages — with no configuration file or extra tool.
14 days free, no credit card required. Your trial starts only when the agent connects to the server.
Every internet-connected server faces thousands of login attempts a day
Bots constantly scan cloud providers’ address ranges, trying common usernames and passwords on every service that responds. Blocking tools need to be configured for each service and distribution. When a log changes, blocking can silently stop working — leaving your server unprotected without anyone knowing.
Every service that accepts a password
SSH, email (Postfix and Dovecot), FTP (vsftpd), and login pages for WordPress, phpMyAdmin, Joomla, and Drupal. Installed services are detected automatically, with nothing to configure.
Know exactly what’s being monitored
The dashboard and the nudefend status command show every service the agent monitors, along with its log source. Any installed service whose logs aren’t being read is clearly flagged, so you won’t mistake it for a protected service.
You won’t get locked out
An address used for a successful login is exempt from automatic blocking for 24 hours. An employee mistyping a password on the same office connection won’t get an already-connected administrator blocked. The server’s own address and VPN networks are always exempt from blocking, too.
Repeat attackers face longer blocks
The first block lasts an hour. If an address tries again within the same day, each new block lasts twice as long, up to a full day.
Blocked by mistake? Unblock with one click
Every blocked address appears in the dashboard with the reason for the block and the number of attempts. Unblocking it with one click also adds it to the allowlist, so it won’t be blocked again.
Site owners don’t get blocked
A normal visit to the WordPress admin login page isn’t treated as an attack. Only attempts with an incorrect password and attempts to access login pages that don’t exist on the server are counted.
Included in nuDefend at no extra cost
Part of nuDefend, at the price you already pay. No separate plan, no per-service charges, and no additional agent to install.
Let your server shut the door itself
Install with a single line. Services are detected automatically, and blocking starts from the first minute.