# CrowdSec

> MIT open-source IDS/IPS and WAF with a community blocklist

**Category:** DevOps  
**Pricing:** open-source  
**URL:** https://docs.crowdsec.net  
**GitHub:** https://github.com/crowdsecurity/crowdsec  
**Added:** 2026-10-18

---

## The Hook

CrowdSec reads your logs and HTTP requests, detects attacks like brute force and scanning, and blocks bad IPs at your firewall, reverse proxy or CDN — a modern fail2ban with a shared reputation network.

## What's Good

MIT (crowdsecurity/crowdsec), release v1.8.1 (2026-09-03). Detection and remediation are separate: parse logs on one machine, block on another via bouncers for nftables, nginx, Traefik, Cloudflare and more. Detection rules on the hub are MIT. The AppSec component is a WAF built on Coraza that loads SecLang rules and the OWASP Core Rule Set, and it can answer suspicious bots with a JavaScript proof-of-work challenge. ★~15.2k.

## The Catch

The community blocklist works by sharing signals: your instance reports attacking IPs to CrowdSec's network, so read the data policy. The web Console and premium blocklists are a commercial layer on top of the free engine. Tuning parsers and scenarios for custom apps takes real effort.

## Verdict

The best free upgrade from fail2ban — especially behind a reverse proxy.