Put your SvrGuard defence line up now

SvrGuard analyses continuously, finds the threatening sources with its own detection rules, and writes their addresses straight into your system firewall — blocked the moment they appear, undisturbed.

Do you know your site is being scanned and attacked right now?

Open your access log and it's full of /wp-login.php, /.env, /phpMyAdmin — things you never installed. That's not traffic; it's probing. Someone is methodically testing every possible way into your server.

You can look up IPs and add firewall rules by hand. Tomorrow there's a fresh batch, and the day after that. You can't win this fight manually — a machine should be watching the logs.

SvrGuard's approach is direct: scan the system logs on a schedule, match them against attack-signature rules, and when it is an attack, write the block into the firewall.

Attacks aren't hypothetical — they're happening now

This is the attack map from a production server in real use: 2,307 addresses from 66 countries blocked automatically in 29 days (as of 2026-09-06). Your server faces the same crowd.

SvrGuard attack map: source country distribution

Attack map: every circle is a country a real attack came from (GeoIP located)

Local dashboard: block status, traffic figures, and firewall backend at a glance

What SvrGuard does

This is how it actually behaves on your host.

Analyses threats on the host itself — reading, matching and deciding all happen on that machine; your logs go to nobody. Once it joins a fleet, only the few request lines a rule flagged as an attack travel with the event as evidence; the rest of your logs stay put.
Events record the attacker only — source IP, rule code, severity and an evidence summary.
Runs standalone, watches nothing about you — it does not read your site's content, does not track your visitors, does not report usage. Connections are always dialled out by that machine, and the local console binds to localhost by default.
Protection works offline — an air-gapped host still detects and blocks, exactly the same.
Your data stays yours — events and blocks live in a local SQLite database, exportable to CSV anytime.

Security you have the moment you install it

There from the start [Free]: detection, blocking, the local console, attack alerts, and watching your own machines on the Hub once they are bound.

You can also subscribe to [Pro] and take the protection further: the threat address database and binary updates delivered automatically, per-host detail and event history, resource monitoring with alerts.

Full feature comparison and pricing →