What is SSH brute-force protection?

SSH brute-force protection stops attackers from guessing SSH passwords by detecting repeated failed logins and firewall-banning the source before it can break in. SSH Protector installs a lightweight Linux agent that watches the SSH (and SFTP and FTP) failed-login events in the systemd journal, and after a configurable number of attempts permanently bans the attacking IP — or its whole /24 subnet on paid plans — with a single consolidated nftables rule, so brute-force bots are blocked at the network edge instead of reaching the login prompt.

How do I protect a Linux server from SSH, SFTP and FTP brute-force attacks?

Install the SSH Protector agent on the server as root. It auto-detects the SSH, SFTP and FTP ports, whitelists your current IP so you can never lock yourself out, and starts banning brute-force sources automatically with safe defaults. Bans are permanent by default and survive reboots, the decision is made locally so protection works even offline, and paid plans add whole-subnet bans, GeoIP rules, a cross-tenant threat database and instant Telegram alerts. Server brute-force protection needs no reverse proxy or extra hardware — one agent per Linux server.

What exactly is free, and for how long?

Free is permanent and needs no card: SSH brute-force protection on one server, blocking of the attacking address, 24 hours of attack history and a whitelist of up to three addresses. It does not expire and it is not a trial. Every new account also gets 14 days of Pro on top, with no card. Paid plans add banning the attacker's whole subnet, SFTP and FTP protection, Telegram alerts, GeoIP rules, longer history and the shared threat database.

How does the 14-day trial work?

Every account gets one, with no card and nothing to cancel. It unlocks the full Pro feature set on your own servers. After 14 days the account returns to Free by itself and protection keeps running: subnet bans fall back to blocking single addresses, Telegram alerts switch off and history shortens to 24 hours. Nothing is ever charged automatically.

What if I need one more server than my plan includes?

Add servers individually for $3 per server per month instead of moving up a tier. Extra servers renew on the same cycle as the plan they extend.

Is it safe to install on a production server?

Yes. The agent only reads its own OS auth log (systemd journal) and blocks inbound connections to the protected ports on the same host. No offensive capabilities, only outbound HTTPS.

Does protection work without a cloud connection?

Yes. The ban decision is made locally on the agent instantly, even offline. If the connection drops, protection keeps working from the local policy.

What if I changed the SSH port?

The agent detects the actual SSH port(s) automatically (sshd_config + listening sockets) and rebuilds the rules on a change. The FTP port is detected the same way.

Will I lock myself out?

No. On install your current IP is automatically whitelisted, and the whitelist always takes priority over any block.

Which Linux distributions are supported?

Any modern systemd-based distribution — Debian, Ubuntu, RHEL/CentOS/Alma/Rocky, Fedora — on x86-64 and ARM64. A single static binary, no extra runtimes.

How does billing work?

Internationally via PayPro Global, in Russia via YooKassa, plus crypto as a fallback channel. Free is perpetual and needs no card.

SSH Protector — SSH/FTP brute-force protection for Linux servers

Managed protection for Linux servers against SSH, SFTP and FTP password-guessing. A lightweight agent bans attacking subnets with one nftables rule, shares reputation across tenants and keeps working offline. 1 server free forever, plus 14 days of Pro — no card.