An nftables/iptables based firewall, login failure daemon, and intrusion detection system for Linux servers, now with a live connection map that shows who is on your server in real time.
A live, animated map of your server: who is connecting to your services, where your processes connect out to, and which IPs need attention right now. Block attackers in one click.
SecLayer turns a complex security stack into a single, self-configuring system. No tuning, no maintenance, no blind spots.
Run a single install command on any major Linux distribution. The installer automatically detects your OS, control panel, and running services - then configures everything with security best practices applied by default.
The Login Failure Daemon continuously tails authentication logs across every service on your server - from SSH and FTP to email and control panel logins. Nothing escapes detection.
When an IP exceeds your configured thresholds, it's immediately blocked at the nftables/iptables level with zero manual intervention. Blocks automatically expire after a configurable duration - no cleanup needed.
Configurable alerts keep you in the loop without notification fatigue. Per-event type settings, smart aggregation, and frequency throttling ensure you never miss a critical event.
Integrated security modules and tools that work together to provide comprehensive server protection. No assembly required.
See every service, outbound process and remote IP on your server in real time. Flags IPs near the DDoS limit, SYN floods and suspicious outbound ports, and blocks them in one click.
Learn more →Automatically blocks brute force attacks across 20+ services. Prevents credential compromise with real-time log monitoring and instant nftables/iptables enforcement.
Learn more →Self-configuring nftables/iptables firewall that scans your services and builds precise allow/deny rules automatically. IPv4, IPv6, and custom port support.
Learn more →Connection-based DoS protection at L3/L4 with per-IP connection limits, port flood detection, and ICMP rate limiting.
Learn more →Port scan detection, exploit pattern matching, and suspicious process tracking. Regex-based log analysis identifies known attack signatures in real time.
Learn more →Configurable alerts via email with smart throttling and aggregation that prevent notification fatigue while keeping you informed.
Learn more →Alerts on new account creation, monitors file integrity, and detects deleted-binary processes across all accounts - from root to reseller to end-user.
Learn more →Deny or allow whole countries or networks (AS numbers) with CC_DENY and CC_ALLOW. Zone data refreshes automatically, so new ranges are covered without any work.
Learn more →A guided checklist of the essentials: allow your own IP, keep SSH and panel ports open, start the firewall and set alerts, each with a one-click fix.
Learn more →Seamless integration with every major hosting platform. Panel-specific features activate automatically when detected during installation.
SecLayer is a modern, actively maintained alternative to ConfigServer Security & Firewall (CSF), familiar to CSF users and built for today's threats.
| Feature | SecLayer | CSF |
|---|---|---|
| Live Connection Map | ✓ Real-time map with one-click blocking | ✗ Not included |
| Login Failure Daemon (LFD) | ✓ 20+ services | ✓ 20+ services |
| Dynamic Firewall | ✓ Auto port discovery | ✓ Manual configuration |
| Intrusion Detection | ✓ Port scan & log monitoring | ✓ Port scan & log monitoring |
| Account Hardening | ✓ File integrity & process tracking | ✓ File integrity & process tracking |
| Guided Security Check | ✓ Checklist with one-click fixes | ✗ Not included |
| DDoS Deflate | ✓ Included | ✗ Not included |
| Webuzo Plugin | ✓ One-click install | ✗ Manual setup |
| Software Updates | ✓ Active | ✗ Stalled (Discontinued) |
| Development Status | ✓ Active | ✗ End of Life (EOL) |
Deploy SecLayer on your servers in minutes. Free on servers with a Softaculous license, $5/server/month otherwise.
