Personal Website Security Protection

2026-01-30 · 7 min read · Caddy Linux ·

Share on:

A while ago, I mentioned that after connecting log monitoring to my website, I discovered that someone was maliciously scanning it every day, resulting in a lot of 404 access records. The access logs not only waste bandwidth but also hinder my troubleshooting. The online world is treacherous; there are always malicious individuals trying to sabotage me.

Previously, I simply deployed fail2ban to prevent SSH brute-force attacks, but unfortunately, I also added log analysis.

Similarly, I can catch more than 10 malicious IPs every day.

1root@tokyo:~# cat /etc/fail2ban/filter.d/caddy-json-scan.conf
2[Definition]
3# Match requests with status=404 and URIs ending in .php, .cgi, .pl, etc.
4# Extract the IP from remote_addr (automatically ignore ports)
5failregex = ^.*"remote_ip":"<HOST>".*"uri":"[^"]*\.(?i:php|cgi|pl|asp)[^"]*".*"status":404.*
6ignoreregex =

This regular expression approach doesn't work for scanning compressed files. For example, many attacks scan .zip/.tar/.gz, etc., HEAD requests, making it tedious to rewrite the matching rules.

Furthermore, fail2ban consumes a lot of memory and has slow hit rate testing, so an alternative solution needs to be found.

I did some research and found that CrowdSec can handle this task. It's an open-source, community-collaboration-based cybersecurity tool used to detect and block malicious activities (such as brute-force attacks, scanning, and web attacks). It identifies suspicious IP addresses in real-time by analyzing log files and can share threat intelligence with users worldwide (with their consent), creating a "collective immunity" defense network. It also handles Caddy log analysis and SSH/FTP brute-force attack defense with ease, making it seem very suitable for personal use.

1. CrowdSec

Installation and usage are very simple:

1curl -s https://install.crowdsec.net | sudo bash
2sudo apt update
3sudo apt list --upgradable
4sudo apt install crowdsec -y
5sudo apt install crowdsec-firewall-bouncer-nftables -y

The crowdsec-firewall-bouncer-nftables is a bouncer (interceptor) provided by CrowdSec. It automatically adds malicious IP addresses detected by CrowdSec to the Linux nftables firewall rules, thereby achieving real-time blocking at the network layer.

During the installation process, CrowdSec automatically identifies which services your system has (such as Postgres, sshd, Nginx, etc.) and automatically loads the corresponding protection modules, which is much more convenient than manually writing regular expressions for fail2ban.

In other words, once a malicious IP is detected, its access request packets are dropped by the system and never reach the Caddy service, significantly reducing malicious scan records. Bouncers can also be implemented at the application level; for example, Caddy has a corresponding interceptor: https://github.com/hslatman/caddy-crowdsec-bouncer. This means interception at the web server level, allowing for more customized operations compared to system-level interception.

I particularly dislike these malicious scans; they're simply dropped at the system level. My hosting provider pays me on time every month; running a website without making money, trying to serve the public, and then getting attacked—nobody's happy about that.

See the output below and feel the evil of this world:

 1root@tokyo:~#  cscli decisions list
 2╭────────┬──────────┬────────────────────┬───────────────────────────────────┬────────┬─────────┬─────────────────────────────────────────────┬────────┬────────────┬──────────╮
 3│   ID   │  Source  │     Scope:Value    │               Reason              │ Action │ Country │                      AS                     │ Events │ expiration │ Alert ID │
 4├────────┼──────────┼────────────────────┼───────────────────────────────────┼────────┼─────────┼─────────────────────────────────────────────┼────────┼────────────┼──────────┤
 5│ 300360 │ crowdsec │ Ip:101.47.161.84   │ crowdsecurity/ssh-slow-bf         │ ban    │ SG      │ 150436 Byteplus Pte. Ltd.                   │ 28     │ 3h53m54s   │ 549      │
 6│ 300359 │ crowdsec │ Ip:101.47.162.19   │ crowdsecurity/ssh-slow-bf         │ ban    │ SG      │ 150436 Byteplus Pte. Ltd.                   │ 27     │ 3h53m22s   │ 548      │
 7│ 300358 │ crowdsec │ Ip:221.14.65.92    │ crowdsecurity/http-probing        │ ban    │ CN      │ 4837 CHINA UNICOM China169 Backbone         │ 12     │ 3h49m40s   │ 546      │
 8│ 300357 │ crowdsec │ Ip:122.192.133.100 │ crowdsecurity/http-bad-user-agent │ ban    │ CN      │ 4837 CHINA UNICOM China169 Backbone         │ 2      │ 3h45m54s   │ 545      │
 9│ 300356 │ crowdsec │ Ip:198.98.57.141   │ crowdsecurity/ssh-slow-bf         │ ban    │ US      │ 53667 PONYNET                               │ 14     │ 3h35m44s   │ 543      │
10│ 285355 │ crowdsec │ Ip:45.78.194.178   │ crowdsecurity/ssh-slow-bf         │ ban    │ SG      │ 150436 Byteplus Pte. Ltd.                   │ 31     │ 3h3m16s    │ 538      │
11│ 285354 │ crowdsec │ Ip:92.118.39.76    │ crowdsecurity/ssh-slow-bf         │ ban    │ US      │ 47890 Unmanaged Ltd                         │ 19     │ 3h2m50s    │ 537      │
12│ 285353 │ crowdsec │ Ip:45.78.219.42    │ crowdsecurity/ssh-slow-bf         │ ban    │ SG      │ 150436 Byteplus Pte. Ltd.                   │ 24     │ 2h53m55s   │ 535      │
13│ 285352 │ crowdsec │ Ip:45.78.229.72    │ crowdsecurity/ssh-slow-bf         │ ban    │ SG      │ 150436 Byteplus Pte. Ltd.                   │ 16     │ 2h45m33s   │ 534      │
14│ 285351 │ crowdsec │ Ip:173.249.50.59   │ crowdsecurity/ssh-slow-bf         │ ban    │ FR      │ 51167 Contabo GmbH                          │ 15     │ 2h43m43s   │ 533      │
15│ 285350 │ crowdsec │ Ip:159.89.143.86   │ crowdsecurity/ssh-slow-bf         │ ban    │ US      │ 14061 DIGITALOCEAN-ASN                      │ 15     │ 2h43m12s   │ 532      │
16│ 285349 │ crowdsec │ Ip:23.236.169.182  │ crowdsecurity/ssh-slow-bf         │ ban    │ US      │ 55286 SERVER-MANIA                          │ 13     │ 2h40m12s   │ 531      │
17│ 285348 │ crowdsec │ Ip:103.175.206.22  │ crowdsecurity/ssh-slow-bf         │ ban    │ ID      │ 147124 PT Hostingan Awan Indonesia          │ 13     │ 2h40m0s    │ 530      │
18│ 285347 │ crowdsec │ Ip:163.61.198.41   │ crowdsecurity/http-probing        │ ban    │ SG      │ 9664 SOUTHEAST ASIA TELECOMSG PTE. LTD.     │ 13     │ 2h37m41s   │ 529      │
19│ 285346 │ crowdsec │ Ip:45.78.193.199   │ crowdsecurity/ssh-slow-bf         │ ban    │ SG      │ 150436 Byteplus Pte. Ltd.                   │ 27     │ 2h34m44s   │ 528      │
20│ 285345 │ crowdsec │ Ip:101.47.163.243  │ crowdsecurity/ssh-slow-bf         │ ban    │ SG      │ 150436 Byteplus Pte. Ltd.                   │ 21     │ 2h30m40s   │ 527      │
21│ 285344 │ crowdsec │ Ip:162.240.109.153 │ crowdsecurity/ssh-slow-bf         │ ban    │ US      │ 46606 UNIFIEDLAYER-AS-1                     │ 14     │ 2h22m55s   │ 524      │
22│ 285343 │ crowdsec │ Ip:181.167.144.229 │ crowdsecurity/ssh-slow-bf         │ ban    │ AR      │ 7303 Telecom Argentina S.A.                 │ 18     │ 2h22m28s   │ 523      │
23│ 285342 │ crowdsec │ Ip:95.90.13.168    │ crowdsecurity/ssh-slow-bf         │ ban    │ DE      │ 3209 Vodafone GmbH                          │ 12     │ 2h21m59s   │ 522      │
24│ 285341 │ crowdsec │ Ip:211.106.133.202 │ crowdsecurity/ssh-slow-bf         │ ban    │ KR      │ 4766 Korea Telecom                          │ 14     │ 2h21m32s   │ 521      │
25│ 285340 │ crowdsec │ Ip:69.63.203.162   │ crowdsecurity/http-probing        │ ban    │ US      │ 3257 GTT Communications Inc.                │ 11     │ 2h9m41s    │ 519      │
26│ 285339 │ crowdsec │ Ip:49.86.41.49     │ crowdsecurity/http-bad-user-agent │ ban    │ CN      │ 146966 China Telecom                        │ 2      │ 1h54m39s   │ 518      │
27│ 285338 │ crowdsec │ Ip:43.134.66.41    │ crowdsecurity/http-probing        │ ban    │ SG      │ 132203 Tencent Building, Kejizhongyi Avenue │ 11     │ 1h29m46s   │ 515      │
28│ 270337 │ crowdsec │ Ip:20.78.169.245   │ crowdsecurity/http-wordpress-scan │ ban    │ JP      │ 8075 MICROSOFT-CORP-MSN-AS-BLOCK            │ 4      │ 56m13s     │ 513      │
29│ 270334 │ crowdsec │ Ip:152.42.225.101  │ crowdsecurity/http-probing        │ ban    │ SG      │ 14061 DIGITALOCEAN-ASN                      │ 11     │ 21m40s     │ 508      │
30╰────────┴──────────┴────────────────────┴───────────────────────────────────┴────────┴─────────┴─────────────────────────────────────────────┴────────┴────────────┴──────────╯

CrowdSec has a wealth of small features, which I won't list here. Overall, it's suitable for personal websites and worth recommending.

2. Caddy Integration with Coraza WAF and rate_limit

Larger companies typically have a WAF layer on the outermost layer of their services; rate_limit can prevent CC attacks, API breaches, brute-force attacks, etc., so we should also include it.

1CGO_ENABLED=1 \
2xcaddy build \
3  --with github.com/dunglas/caddy-cbrotli \
4	--with github.com/mholt/caddy-ratelimit \
5	--with github.com/corazawaf/coraza-caddy/v2

I compiled the above non-standard modules on my computer and then uploaded them directly to the server. The server configuration was too low, so it couldn't compile and would affect users. caddy-cbrotli adds br support; the last two are for ratelimit and WAF.

Result Verification:

 1➜  ~ ./caddy list-modules | tail -n 10
 2
 3  Standard modules: 127
 4
 5http.encoders.br
 6http.handlers.rate_limit
 7http.handlers.waf
 8
 9  Non-standard modules: 3
10
11  Unknown modules: 0

WAF Configuration Snippet Example:

 1# --- 1. Coraza WAF Core Protection ---
 2# For static sites, we mainly block abnormal scanning and malicious User-Agent
 3coraza_waf {
 4    directives `
 5        SecRuleEngine On
 6        SecRequestBodyAccess On
 7        SecDebugLogLevel 0
 8
 9        # Block common malicious scanners
10        SecRule REQUEST_HEADERS:User-Agent "(sqlmap|grabber|cgiscan|nessus|nikto|dirbuster|pangolin)" \
11            "id:101,phase:1,deny,status:403,msg:'Malicious Scanner Detected'"
12
13        # Prevent attempts to access sensitive file paths
14        SecRule REQUEST_URI "\.(git|env|config|php|asp|aspx|jsp|cgi|exe)$" \
15            "id:102,phase:1,deny,status:404,msg:'Path Traversal Attempt'"
16    `
17}

Test verification is normal, as shown below:

1➜ ~ curl -A "sqlmap" https://mephisto.cc
2Error: 403 Forbidden⏎
3➜ ~ curl -I https://mephisto.cc/.env
4HTTP/2 404
5alt-svc: h3=":443"; ma=2592000

Rate Limiting Example:

 1:80
 2
 3rate_limit {
 4	distributed
 5	zone static_example {
 6		match {
 7			method GET
 8		}
 9		key    static
10		events 100
11		window 1m
12	}
13	zone dynamic_example {
14		key    {remote_host}
15		events 2
16		window 5s
17	}
18	log_key
19}
20
21respond "I'm behind the rate limiter!"

I added rate limiting a long time ago because I was really worried about people spamming the API.

Some RSS software not only accesses the RSS source file but also frequently scrapes the full text, which defies common sense. I also dealt with these through UA identification.

3. Summary

This combination of measures can basically defend against some common attacks for personal servers without any additional cost. Small websites operate with integrity and low profile, serving the people. Since there's no profit to be made, it's probably not a target for professional attack groups.

Lastmod： Saturday, January 31, 2026

Copyright statement:

All content that is not sourced is original., please do not reprint without authorization (because the typesetting is often disordered after reprinting, the content is uncontrollable, and cannot be continuously updated, etc.);
For non-profit purposes, to deduce any content of this blog, please give the relevant webpage address of this site in the form of 'source of original text' or 'reference link' (for the convenience of readers).

Personal Website Security Protection

1. CrowdSec

2. Caddy Integration with Coraza WAF and rate_limit

3. Summary

Copyright statement:

See Also:

Translations: