Protect Windows and Linux servers from brute-force attacks, hostile authentication attempts and malicious web traffic, with local firewall enforcement, certificate/TLS posture assessment and optional centralized Datacenter management.
Protect Windows Server from repeated RDP, IIS/RDWeb, Kerberos and SQL Server authentication attacks with deterministic monitoring and Windows Firewall blocking.
Linux server brute-force and hostile web request protection for SSH, Apache, Nginx, Tomcat and WildFly using local evidence and nftables enforcement.
WordPress security for shared hosting and self-hosted sites with local blocking, grouped incidents, Tor protection, enriched reports and optional Scantide/third-party intelligence.
Centrally manage Scantide Guard across Windows and Linux servers with shared policy, per-monitor rules and notification routing, security events, licensing, reputation and fleet visibility.
Scantide Guard Legacy extends failed-logon and attack blocking capabilities to older Windows Server environments that still require operational protection.
Windows Server 2008 R2 SP1, 2012 R2, 2016, 2019, 2022 and 2025, Windows 10/11, plus Linux targets including Ubuntu and other supported systemd-based distributions.
Automatically detect repeated failed logins and block hostile source IPs on Windows and Linux servers with configurable, explainable Guard policies.
Detect repeated RDP authentication failures and automatically block attacking IP addresses using Windows security events and Windows Firewall.
Detect repeated SSH login failures and automatically block hostile IP addresses on Linux with Scantide Guard and local firewall enforcement.
Detect hostile web probes, path traversal attempts, secret-file requests, scanner bursts and repeated 403/404 behavior across supported web servers.
Host-level intrusion and abuse prevention for Windows and Linux using authentication logs, web evidence, reputation context and local firewall response.
Looking beyond Fail2ban? Scantide Guard provides failed-login blocking, Windows and Linux support, centralized policy and richer attack context.
Compare the Scantide Guard approach to RDP-focused brute-force protection: Windows and Linux collectors, centralized Datacenter management and custom monitoring.
Turn application logs and Windows Event channels into Guard security evidence with custom parsers, authentication classification, per-monitor rules and application-aware notification routing.
Browse reviewed and community-submitted monitor definitions for applications and services. Installed monitors use the same policy, statistics and notification model as Guard's built-in collectors.
Discover certificate stores and local PFX/PEM files, review expiry, chain and private-key readiness, and assess local TLS/cryptography posture with separate client/server protocol visibility. 0.8.2 remains reconnaissance and validation-only.
Use Scantide Guard assessment reporting to review system health, security posture, software, CVEs, lifecycle, services, disks, firewall and other server evidence.
Windows uses one unified installer. It contains Guard and Datacenter for supported modern Windows systems and automatically selects the compatible Legacy Guard implementation on Windows Server 2008 R2 SP1. There is no separate Windows Legacy or Windows Datacenter installer.
For Windows Server 2008 R2 SP1 and later, including Windows Server 2012 R2, 2016, 2019, 2022 and 2025. Also suitable for validated Windows client deployments such as Windows 11.
Download unified Windows installerSHA-256
ba805e33dcf7eb8f3bdb55b31df5a6c3a307c01a07f73f1149dfe57563410591
Get-FileHash .\ScantideGuard-0.8.4-Setup.exe -Algorithm SHA256
Install Linux Guard with the bootstrap installer. The bootstrap reads the live release manifest and verifies the downloaded package before installation.
curl -fsSL https://www.scantide.com/guard/install.sh | sudo bashDownload Linux Guard directly
SHA-256
2d0edf8556c6b13e8308fa7537b220290f25b95f3a9932520d3b0bcbec6574cb
Run the central Scantide Guard Datacenter service on Linux when that better fits your management infrastructure.
curl -fsSL https://www.scantide.com/guard/install-datacenter.sh | sudo bashDownload Linux Datacenter directly
SHA-256
89f1d88920f924d9f53924557085c112012feb66b13a50373c5ed3219d23eeff
The trial is fully functional. Use the complete Guard protection, blocking, monitoring and management workflow during the 30-day evaluation period before deciding on licensing.
The same Windows installer is used for Guard, Datacenter and Legacy Guard selection. Linux Guard and Linux Datacenter remain separate Linux packages.
Review OS compatibilityBuilt-in collectors and Custom Monitors use the same operational model for enablement, health, activity, blocking policy and notifications. A monitor can inherit the normal server policy or use application-specific thresholds, correlation windows, block duration and recipient routing.
Use the global defaults for most services, then override thresholds, windows or block duration only where an application needs different behavior.
Monitor notifications can inherit global recipients, add application-specific recipients or replace the normal list, with optional escalation back to server and security administrators for blocking events.
LAN discovery and security assessment reports can use their own recipient lists so network, infrastructure, application and security teams receive the information relevant to them.
Guard can now inventory local certificate material and make certificate/TLS posture easier to understand without changing the system. Run a Windows certificate-store check, sweep local certificate files or run a full certificate reconnaissance pass. Findings are presented per certificate with expiry, chain, private-key state, likely consumer and replacement-readiness context.
Review Windows certificate stores and local PFX/P12/PEM/CER/CRT files, including application-oriented locations such as CrushFTP and common web/proxy certificate paths.
TLS posture distinguishes inbound server settings from outbound client settings. Raw Schannel/OpenSSL and configuration evidence remains available for administrators who need the detail.
Managed Guards can report compact certificate and TLS/cryptography posture to Datacenter so fleet-level issues are visible per Guard.
Under development: certificate handling in 0.8.2 is reconnaissance and validation-only. Guard does not automatically replace certificates, export private keys, change trust roots or rebind services.
0.8.4 adds a separate scheduled reporting channel alongside immediate attack alerts. Scantide Guard for WordPress has meanwhile advanced to 0.9.7 with shared-hosting local blocking, grouped incidents, Tor protection, enriched reporting, secure integrations and independent intelligence fallbacks.
Send scheduled Guard summaries with attack attempts, unique attackers, blocked activity, temporary/permanent blocks, top attackers, countries and collectors/rules.
Statistics reports reuse the configured SMTP transport but have their own enablement and recipients, keeping management summaries separate from immediate incident alerts.
WordPress 0.9.7 remains useful on shared hosting with local blocking, grouped incidents, Tor protection, inventory, enriched alerts/reports and CSV export, then adds Scantide correlation/Guard integration when available.
Legal and operational guidance is available in-product, with clearer warnings around potentially disruptive blocking, firewall, certificate and TLS actions.
Use the administrator manual for installation, configuration, collectors, blocking policy, Datacenter enrollment and operations.
Open Guard Manual