Explore focused Guard pages for Windows, Linux, centralized management, RDP, SSH, hostile web traffic, custom application logs and server posture.
Protect Windows Server from repeated RDP, IIS/RDWeb, Kerberos and SQL Server authentication attacks with deterministic monitoring and Windows Firewall blocking.
Linux server brute-force and hostile web request protection for SSH, Apache, Nginx, Tomcat and WildFly using local evidence and nftables enforcement.
WordPress protection for shared hosting and self-hosted sites with grouped incidents, local blocking, Tor protection, enriched reporting and optional Scantide, AbuseIPDB, OTX and Wordfence intelligence.
Centrally manage Scantide Guard across Windows and Linux servers with shared and per-monitor policy, role-aware notification routing, security events, licensing, reputation and fleet visibility.
Scantide Guard Legacy extends failed-logon and attack blocking capabilities to older Windows Server environments that still require operational protection.
Automatically detect repeated failed logins and block hostile source IPs on Windows and Linux servers with configurable, explainable Guard policies.
Detect repeated RDP authentication failures and automatically block attacking IP addresses using Windows security events and Windows Firewall.
Detect repeated SSH login failures and automatically block hostile IP addresses on Linux with Scantide Guard and local firewall enforcement.
Detect hostile web probes, path traversal attempts, secret-file requests, scanner bursts and repeated 403/404 behavior across supported web servers.
Host-level intrusion and abuse prevention for Windows and Linux using authentication logs, web evidence, reputation context and local firewall response.
Looking beyond Fail2ban? Scantide Guard provides failed-login blocking, Windows and Linux support, centralized policy and richer attack context.
Compare the Scantide Guard approach to RDP-focused brute-force protection: Windows and Linux collectors, centralized Datacenter management and custom monitoring.
Extend Guard beyond its preinstalled collectors with custom parsers, failed/successful authentication classification, per-monitor rules, application-owner notifications and Datacenter-managed distribution.
Browse reviewed and community-submitted Custom Monitor definitions for applications and services, with provenance and reusable Guard policy integration.
Discover certificate stores and local PFX/PEM files, review expiry, chain and private-key readiness, and assess local TLS/cryptography posture with separate client/server protocol visibility. 0.8.2 remains reconnaissance and validation-only.
Use Scantide Guard assessment reporting to review system health, security posture, software, CVEs, lifecycle, services, disks, firewall and other server evidence.
These buttons are read from the same live Guard update manifest as the original product page, so they follow the currently published beta release.
The same Windows installer covers Guard and Datacenter on supported modern Windows systems and automatically selects Legacy Guard on Windows Server 2008 R2 SP1.
Download unified Windows installercurl -fsSL https://www.scantide.com/guard/install.sh | sudo bashDirect tar.gz
curl -fsSL https://www.scantide.com/guard/install-datacenter.sh | sudo bashDirect tar.gz
See the current Windows Server, Windows client, Legacy Windows and Linux compatibility overview, including which platforms are tested, targeted or still awaiting explicit validation.
View OS compatibilityScantide Guard is designed for mixed Windows Server environments including Windows Server 2008 R2 SP1, 2012 R2, 2016, 2019, 2022 and 2025. One unified Windows installer covers Guard and Datacenter, while automatically selecting Legacy Guard on Windows Server 2008 R2 SP1.
See supported operating systemsGuard does more than count failures. Supported built-in collectors and Custom Monitors can also classify successful authentication. That lets Guard learn which source addresses are repeatedly associated with legitimate administration and use that evidence to reduce unnecessary blocking.
When a trusted authentication source reports a successful login, Guard can use that evidence to learn or reinforce the source as a known administrative origin instead of treating every future failure from that address as hostile.
A successful login can reset or contextualize the active failure counter for the same source where the monitor supports it, helping distinguish mistyped credentials from a sustained brute-force attack.
Custom Monitors can classify both failed and successful authentication, so trusted-source learning is not limited to RDP or other built-in collectors. Applications with usable login evidence can participate in the same model.
Learned trust should remain visible and auditable: administrators can see why a source became trusted and distinguish learned entries from manually configured allow lists.
The goal is not to permanently trust any IP that happens to log in once. Trust decisions are tied to supported authentication evidence and Guard policy so administrators retain control.
Combined with Datacenter, successful-login intelligence can help reduce friction for known management sources while keeping attack blocking and repeat-offender handling active across the fleet.
Scantide Guard can use successful authentication evidence from supported built-in collectors and Custom Monitors to recognize trusted administration sources, reset or contextualize active failure history where appropriate, and reduce unnecessary blocking without weakening the deterministic protection model.
Trusted authentication evidence can help Guard distinguish legitimate administration from repeated hostile attempts.
Successful authentication can reset or contextualize active failure counters where supported, helping avoid blocking known legitimate sources after simple mistakes.
Custom Monitors can classify both failed and successful authentication, so trusted-source learning can extend to your own applications as well.
Datacenter also supports Windows Server 2008 R2 SP1. The unified Windows installer covers the Windows Guard family, including modern Guard, Legacy Guard selection, and Datacenter installation without requiring a separate Datacenter package.
Explore DatacenterReceive 24-hour or 7-day host-level summaries without sending every immediate security event to the same recipients.
Aggregate managed-server security activity, blocks, attackers, countries, collectors and most-targeted systems.
Use WordPress 0.9.7 on shared hosting or self-hosted sites for grouped incidents, local blocking, Tor protection, enriched alert/statistics email, inventory and optional AbuseIPDB, OTX, Wordfence and Scantide intelligence.