CrowdSec
MIT open-source IDS/IPS and WAF with a community blocklist
DevOps / Infrastructure · OSS/MIT · 15.2k
Reviewed 2026-10-18 · last push 2026-10-18 · repo checked 2026-10-19
What's Good
MIT (crowdsecurity/crowdsec), release v1.8.1 (2026-09-03). Detection and remediation are separate: parse logs on one machine, block on another via bouncers for nftables, nginx, Traefik, Cloudflare and more. Detection rules on the hub are MIT. The AppSec component is a WAF built on Coraza that loads SecLang rules and the OWASP Core Rule Set, and it can answer suspicious bots with a JavaScript proof-of-work challenge. ★~15.2k.
The Catch
The community blocklist works by sharing signals: your instance reports attacking IPs to CrowdSec's network, so read the data policy. The web Console and premium blocklists are a commercial layer on top of the free engine. Tuning parsers and scenarios for custom apps takes real effort.
Verdict
The best free upgrade from fail2ban — especially behind a reverse proxy.
Embed
Maintainer? Add the badge to your README. It is free, links to this review, and there is no paid version.
Markdown
[](https://stackgems.com/gems/crowdsec)
HTML
<a href="https://stackgems.com/gems/crowdsec"><img src="https://stackgems.com/badge/crowdsec.svg" alt="CrowdSec reviewed on Stack Gems" height="20"></a>