SecLayer
Enterprise Firewall Security Made Simple

An nftables/iptables based firewall, login failure daemon, and intrusion detection system for Linux servers. Actively maintained and ready for production.

How It Works ↓
SecLayer Shield
How It Works

Install. Monitor. Protect.

SecLayer turns a complex security stack into a single, self-configuring system. No tuning, no maintenance, no blind spots.

One Command. Zero Configuration.

Run a single install command on any major Linux distribution. The installer automatically detects your OS, control panel, and running services - then configures everything with security best practices applied by default.

  • Auto-detects CentOS, RHEL, AlmaLinux, Rocky, Ubuntu, Debian, CloudLinux
  • Recognizes and integrates with 8+ control panels automatically
  • Lightweight PHP core with a C log-tailer daemon
  • Detects existing CSF installations and can migrate your config to SecLayer, then remove CSF with your permission
Installation Output
wget -O seclayer.sh https://a.softaculous.com/seclayer/files/install.sh chmod 0755 seclayer.sh ./seclayer.sh [OK] Detected OS: AlmaLinux 9 x86_64 [OK] Detected control panel: Webuzo [OK] Firewall rules applied [OK] LFD daemon started

Real-Time Visibility Across All Services

The Login Failure Daemon continuously tails authentication logs across every service on your server - from SSH and FTP to email and control panel logins. Nothing escapes detection.

  • Monitors 20+ log file types simultaneously with zero overhead
  • Tracks SSH, FTP, SMTP, POP3, IMAP, cPanel, Webmail, and more
  • Configurable failure thresholds per service type
  • PTR record lookup with regex pattern matching against offending IPs
LFD Activity Log
2026-05-30 10:37:50 server lfd[2050]: Daemon started - SecLayer lfd v14.17 2026-05-29 14:32:01 server lfd[2050]: LF_SSHD: 203.0.113.42 - 12 failures in 60s 2026-05-29 14:32:01 server lfd[2050]: BLOCKED: 203.0.113.42 added to nftables/iptables 2026-05-29 14:31:45 server lfd[2050]: LF_FTPD: 198.51.100.17 - 8 failures in 120s 2026-05-29 14:31:30 server lfd[2050]: LF_SMTP: 192.0.2.88 - 15 failures in 300s 2026-05-29 14:31:30 server lfd[2050]: BLOCKED: 192.0.2.88 added to nftables/iptables

Automatic Firewall Enforcement

When an IP exceeds your configured thresholds, it's immediately blocked at the nftables/iptables level with zero manual intervention. Blocks automatically expire after a configurable duration - no cleanup needed.

  • Instant nftables/iptables blocking with per-IP tracking
  • Configurable temporary and permanent block lists
  • Auto-expiry with permanent blocking for repeat offenders
  • Full IPv4 and IPv6 support with stateful connection tracking
Firewall Status
root@server:~# seclayer -l Chain INPUT (policy DROP) num target prot opt source destination 1 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 2 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 3 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 4 DROP all -- 203.0.113.42 0.0.0.0/0 5 DROP all -- 198.51.100.17 0.0.0.0/0 6 ACCEPT all -- 10.0.0.0/8 0.0.0.0/0

Stay Informed, Not Overwhelmed

Configurable alerts keep you in the loop without notification fatigue. Per-event type settings, smart aggregation, and frequency throttling ensure you never miss a critical event.

  • Per-event-type email alerts with custom templates
Alert Configuration
# /etc/seclayer/seclayer.conf TESTING = "0" LF_ALERT_TO = "[email protected]" LF_ALERT_FROM = "[email protected]" LF_ALERT_SMTP = "mail.example.com" PTR_ALLOW = "1" IGNORE_ALLOW = "0"
Everything Included

Complete Protection Out of the Box

Six integrated security modules that work together to provide comprehensive server protection. No assembly required.

Login Failure Daemon

Automatically blocks brute force attacks across 20+ services. Prevents credential compromise with real-time log monitoring and instant nftables/iptables enforcement.

Learn more →

Dynamic Firewall

Self-configuring nftables/iptables firewall that scans your services and builds precise allow/deny rules automatically. IPv4, IPv6, and custom port support.

Learn more →

DDoS Mitigation

Connection-based DoS protection at L3/L4 with per-IP connection limits, port flood detection, and ICMP rate limiting.

Learn more →

Intrusion Detection

Port scan detection, exploit pattern matching, and suspicious process tracking. Regex-based log analysis identifies known attack signatures in real time.

Learn more →

Alerting & Notifications

Configurable alerts via email with smart throttling and aggregation that prevent notification fatigue while keeping you informed.

Learn more →

Account Hardening

Alerts on new account creation, monitors file integrity, and detects deleted-binary processes across all accounts - from root to reseller to end-user.

Learn more →
Integrations

Works With Your Control Panel

Seamless integration with every major hosting platform. Panel-specific features activate automatically when detected during installation.

Webuzo

Fully Supported

cPanel / WHM

Fully Supported

DirectAdmin

Coming Soon

Plesk

Coming Soon

InterWorx

Coming Soon

CWP

Coming Soon
Why SecLayer

SecLayer vs. CSF

SecLayer is the modern successor to ConfigServer Security & Firewall (CSF) - built on the same legacy, evolved for today's threats.

Feature SecLayer CSF
Login Failure Daemon (LFD) ✓ 20+ services ✓ 20+ services
Dynamic Firewall ✓ Auto port discovery ✓ Manual configuration
Intrusion Detection ✓ Port scan & log monitoring ✓ Port scan & log monitoring
Account Hardening ✓ File integrity & process tracking ✓ File integrity & process tracking
DDoS Deflate ✓ Included ✗ Not included
Webuzo Plugin ✓ One-click install ✗ Manual setup
Software Updates ✓ Active ✗ Stalled (Discontinued)
Development Status ✓ Active ✗ End of Life (EOL)
FAQ

Common Questions Answered

Which Linux distributions are supported?
SecLayer supports CentOS, RHEL, AlmaLinux, Rocky Linux, Ubuntu, Debian, and CloudLinux on 64-bit architecture. The installer automatically detects your distribution and configures all components accordingly - no manual setup required.
Do I need a control panel to use SecLayer?
Not at all. SecLayer works perfectly on standalone Linux servers. When a supported control panel is detected, additional integration features such as user tracking and service monitoring become available automatically - but they're never required.
How is SecLayer licensed?
SecLayer is a commercially licensed product. Contact us for licensing details.
How much does deployment impact server performance?
Minimal. SecLayer is written primarily in PHP for easy integration with hosting control panels. The lightweight C log-tailer uses negligible CPU during normal operation.
How does SecLayer handle false positives?
Thresholds are configurable per service type, and you can maintain permanent allow lists for trusted IPs. The ignore list feature excludes specific IPs from LFD tracking. Temporary blocks expire automatically, and administrators can manually unblock IPs through CLI or dashboard.
Can I customize how alerts are sent?
Yes. Alerts are configurable on a per-event-type basis with custom message templates. You can receive alerts via email or custom integration scripts that hook into your existing monitoring stack.

Ready to Secure Your Infrastructure?

Deploy SecLayer on your servers in minutes. Enterprise-ready security. No registration required - just run the installer.

Read the Docs