CrowdSec
Collaborative runtime protection, open source, made in France.
CrowdSec is one of the most relevant runtime security tools for SMBs. Born in France in 2020, it works on a simple principle: each server anonymously shares the IPs attacking it, and receives in return the consolidated list of IPs already flagged as malicious by the community. For an SMB hosting its own site, that means bots, scanners and known attackers are blocked before they even reach your application.
My take on CrowdSec: it's a good tool, and that doesn't make it the right choice for every SMB.
Fail2ban has been the reference since 2004. It's still useful but remains local.
CrowdSec keeps that minimalist philosophy while adding collective intelligence: you benefit from observations of thousands of other servers without sharing anything sensitive. The bonus is French origin and an open-source ecosystem: no proprietary vendor lock-in, no sovereignty concern to address.
The reservation fits in one sentence, and it often decides the choice: it has to be tuned, and it has to be watched. If nobody on your side will be maintaining its scenarios six months from now, protection placed at the network edge or a hardened turnkey distribution will protect you better — because it will keep doing so once nobody touches it any more.
- →Exposed server (VPS, dedicated, public K8s) with web services
- →Logs already available (nginx, SSH, applicative)
- →No desire to build a full SIEM, but need for real perimeter defense
- →Sovereignty or GDPR concerns: European, open-source tool
- ×Doesn't replace a full WAF for highly exposed applications: ModSecurity or Cloudflare WAF remain complementary
- ×Requires clean initial configuration (parsers, scenarios): not an 'install and forget' tool
- ×Effectiveness depends on log quality: if the app logs poorly, CrowdSec sees poorly
- →Fail2banSimpler, local-only: no collective community intelligence
- →Cloudflare WAFProprietary front-end protection: complementary application defenseView page
- →ModSecurityOpen-source WAF paired with nginx/Apache, more focused on HTTP requests
- →WazuhIf you need a full SIEM with HIDS detection capabilitiesView page
- →NginxRate limiting set at the proxy: coarser, but already in place and with no extra service to operateView page
- →BunkerWebHardened nginx distribution with filtering and blocking built in: one brick to maintain rather than three to assemble
- 01
Installation on the relevant servers, deployed through automation rather than machine by machine
- 02
Scenario configuration tailored to the stack (nginx, SSH, specific app)
- 03
Firewall integration (nftables, iptables, Cloudflare via bouncer)
- 04
Centralized dashboard if multiple servers
- 05
Documentation and training: security must stay understandable
+ Related services
Offerings associated with this techWhat's the difference between CrowdSec and Fail2ban?
Fail2ban has been the reference tool since 2004: it bans attacking IPs from your server, locally. CrowdSec extends this principle by anonymously sharing malicious IPs between servers. You benefit from observations of thousands of other servers without sharing anything sensitive. CrowdSec is also more modern in its configuration and scenarios.Is CrowdSec really free?
The main engine and community blocklist are open source and free. Premium blocklists (additional commercial sources) are paid via subscription starting at a few euros per month per server. For the vast majority of SMBs, the free version more than covers needs.Does CrowdSec replace a full WAF?
No. CrowdSec is an excellent perimeter defense layer (blocking known malicious IPs), but it doesn't replace an application WAF (ModSecurity, Cloudflare WAF, AWS WAF) which inspects HTTP request content. For complete protection, both are complementary: CrowdSec in front, WAF behind.What does a CrowdSec setup cost?
The weight isn't installing the engine, it's the tuning: the number of servers, the quality of the existing logs — a service that logs badly is protected badly — the scenarios to adapt to your stack, integration with the firewall or the edge service, and whether a central console is needed. The amount is set in the quote, after a free initial scoping session that puts the scope in writing before any commitment.Do my logs go to CrowdSec?
No. Only detected attack patterns (IP addresses, type of triggered scenario) are reported to the community, in anonymized form. Your logs themselves stay on your server. This is explicitly documented by the vendor and auditable in the open-source code.
A project involving CrowdSec?
Describe your context: I'll suggest the right level of investment.
First callLet's talk aboutyour project.
Describe your need in a few lines. Reply within 2 business days to plan next steps, detailed quote within 5 business days.
- Reply within 2 business days
- NDA on request
- Remote anywhere in France