crowdsec
CrowdSec is a free, open-source and collaborative IPS.
Platform availability
Available on 4 of 9 platforms
Health score?A 0-100 score computed nightly from four factors: maintained (40%: recent commits and steady activity), popular (25%: GitHub stars, log scale), easy to install (20%: platforms, install notes, setup guides, Docker image) and light to run (15%: minimum RAM, ARM support). When the source code has been checked, a fifth factor, security check (20%: automated scan for committed secrets, unsafe desktop-app settings, known-vulnerable dependencies and project hygiene; any serious finding caps it at 20), is added. Factors without data are left out and the rest are rescaled.
86/100 Excellent
- Maintained
- 100last commit 6 days ago
- Popular
- 8415,101 GitHub stars
- Easy to install
- 553 install platforms, install notes, Docker image
- Light to run
- 95512 MB minimum RAM, runs on ARM
Availability: platform listings confirmed today, links checked 14 days ago
- GitHub stars
- 15,101
- Open issues
- 305
- Last commit
- 2026-10-07
- Latest release
- v1.8.1
- License
- MIT
- Activity
- steady
Checked 6 days ago - source: GitHub (crowdsecurity/crowdsec)
Resources & Compatibility
Minimum requirements: 512 MB RAM, 100 MB disk. ARM (e.g. Raspberry Pi) is supported.
Checked 15 days ago - source: Docker Hub image tags and published docs
First-install notes
- Use interactive setup first Run cscli setup interactive before doing much else, because it detects which services are running and offers the matching log sources (where CrowdSec reads activity files) and rules. Without this, CrowdSec may not see the logs it needs, so it can’t warn you or block bad traffic. source
- Install parsers for your logs Install only the parsers that match your logs, for example cscli parsers install crowdsecurity/sshd-logs crowdsecurity/caddy-logs. Parsers are the parts that turn raw log lines into events CrowdSec can understand, so missing parsers mean it sees your logs but cannot detect problems. source
- Add Cloudflare tokens before start If you are setting up the Cloudflare Worker bouncer, put your CrowdSec API tokens into the command with -g <TOKEN1>,<TOKEN2> before starting it. The bouncer uses those tokens to ask CrowdSec what to block; if they are missing or wrong, Cloudflare cannot apply bans and bad traffic can still get through. source
Fetched 15 days ago - each note links to its source
Variants
Alternatives (4)
- Cloudflare - Protects websites with front-end proxy, dynamic DNS, CDN, and firewall; blocks DDoS and targeted attacks, optimizes traffic, and analyzes t…
- Fail2ban - Fail2ban is a daemon that monitors log files and automatically bans hosts that cause multiple authentication failures, using firewall rules…
- IPBanPro - IPBan is a FREE and open source application that allows auto banning ip addresses from failed login attempts.
- defensia-agent
Checked 12 days ago - source: AlternativeTo
Common questions
Do I need an extra component when running CrowdSec with Traefik?
Yes, if you use Traefik you should also install the traefik-bouncer. It lets CrowdSec apply blocks at the reverse proxy.
What setup step should I run first to make CrowdSec see my services?
Run cscli setup interactive before doing much else. It detects which services are running and offers the matching log sources and rules.
What should I do if CrowdSec sees my logs but does not detect problems?
Install only the parsers that match your logs, such as for sshd or caddy logs. Missing parsers prevent CrowdSec from understanding raw log lines and detecting issues.
How do I configure the Cloudflare Worker bouncer with CrowdSec?
Add your CrowdSec API tokens to the command before starting it. If the tokens are missing or wrong, Cloudflare cannot apply the bans.
Is AppSec the same as the main CrowdSec engine?
No, CrowdSec is focused on blocking attackers while AppSec is more about reducing application development risks.
Answers sourced from doc.crowdsec.net, doc.crowdsec.net, doc.crowdsec.net, github.com, www.reddit.com
Community
Collected 14 days ago - public community threads