Monitors authentication logs across 20+ services in real time. Automatically blocks brute force attackers before they compromise accounts.
SSHD, FTP, SMTP, IMAP, cPanel & moreProduction-ready nftables/iptables firewall with secure-by-default port settings. Easy customization through the configuration file.
IPv4 + IPv6 · Auto port discoveryConnection-based DoS protection at L3/L4 with per-IP connection limits, port flood detection, and ICMP rate limiting.
Per-IP limits · Cloudflare APIConfigurable per-event-type email alerts with custom templates and external script hooks.
EmailDetects port scans, exploit attempts, and suspicious processes. Regex-based pattern matching identifies known attack signatures.
Port scan · Exploit · Process monitoringAlerts on new account creation, monitors file integrity, and detects deleted-binary processes across all accounts.
File integrity · Policy enforcementRecent additions that make SecLayer easier to set up, easier to run across many servers, and harder to get past.
A guided checklist of the essentials — allow your own IP, keep SSH and panel ports open, start the firewall, set alerts — each with a one-click fix.
Dashboard progress ·seclayer --security-check
Moves your CSF allow/deny/ignore lists, ignore files and settings to SecLayer, then disables CSF and starts SecLayer. CSF itself is never uninstalled.
seclayer --csfmigrate
Deny or allow whole countries or networks (AS numbers) with CC_DENY and CC_ALLOW. Zone data refreshes automatically.
GeoIP · ASN prefixes · Auto refreshSubscribe to public threat-intelligence feeds and keep them loaded into the firewall, refreshed on their own schedule.
Feeds · ipset-backed · Auto refreshBan or allow an IP on one server and every peer in the group applies it too. Messages are signed with a shared key.
Multi-server · HMAC-signedKeep one central allow or deny list at a URL and have every server pull it in — manage a fleet from one file.
GLOBAL_ALLOW · GLOBAL_DENYBlocks are also pushed to Cloudflare IP Access Rules, so attackers are stopped at the edge using their real visitor IP.
Cloudflare APICheck your server IPs against major DNS blocklists on demand, or get an hourly, daily, weekly or monthly email report.
Scheduled email reportsHide services behind a port-knock sequence and rate-limit SYN, UDP and per-port floods with connection limits.
PORTKNOCKING · SYNFLOOD · CONNLIMITCollected history for system load, disk, MySQL and Apache, so you can see what was happening when an alert fired.
Charts in the admin panelTail logs live or search across them for an IP or pattern straight from the admin panel — no SSH session needed.
Live tail · Log searchEvery update package is signature-verified before it is installed, so only genuine SecLayer releases are applied.
Signature verificationDetailed breakdown of every component in the SecLayer security stack.
Native integration with every major hosting platform. Features activate automatically when detected during installation.
