VistoShield is a two-part security platform: a powerful Linux firewall daemon that replaces CSF/LFD, and 5 specialized WordPress security plugins that work standalone or connect to the server for enhanced protection.
Free & open source. GPL-2.0 license.
The modern replacement for CSF/LFD. Protect your Linux server with a powerful firewall daemon.
nftables + iptables/ip6tables fallback. Full IPv6 support. SYN flood protection, connection tracking, and automatic failover.
Monitor SSH, FTP, POP3/IMAP, SMTP, DirectAdmin, cPanel, Webmin, and ModSecurity. Configurable per-service thresholds and automatic blocking.
143+ bot signatures with behavioral scoring engine. rDNS verification for search engines. Block, challenge, or monitor suspicious traffic.
CC_DENY / CC_ALLOW with auto-updated CIDR lists. Block or allow entire countries with a single config line.
FireHOL integration with auto-updated blocklists. Known malicious IPs are automatically detected and rate-limited at the firewall level.
TCP/UDP port filtering, connection tracking with ss-based IPv6-aware monitoring, and configurable connection limits per IP.
Manage VistoShield from your favorite hosting control panel.
Full admin & user-level plugin with real-time dashboard, settings, blocked IPs, allow/deny lists, and log viewer.
AvailableComplete Webmin module with configuration editor, blocked IP management, signature management, and deny list.
AvailableWHM plugin for server-wide management. cPanel interface for individual account protection.
Coming SoonDeploy in minutes. No cloud dependency. Everything runs on your server.
One command installs VistoShield on your Linux server. Supports Ubuntu, Debian, AlmaLinux, and CentOS.
bash install.sh
Edit vistoshield.conf or use the DirectAdmin/Webmin control panel plugin. Enable features, set thresholds, add trusted IPs.
Real-time dashboard shows firewall status, blocked IPs, and security events. Email alerts for critical events. Daily security reports.
VistoShield is the modern, actively maintained alternative to ConfigServer Security & Firewall.
| Feature | CSF/LFD | VistoShield |
|---|---|---|
| nftables support | Limited | Full native support |
| IPv6 | Partial | Complete (blocking, whitelisting, CIDR) |
| Bot detection | None | 143+ signatures + behavioral scoring |
| WordPress integration | None | 5 dedicated security plugins |
| Country blocking | Yes | Yes (auto-updated CIDR lists) |
| Connection tracking | Yes | Yes (ss-based, IPv6 aware) |
| Web UI | cPanel/WHM only | DirectAdmin + Webmin + cPanel |
| Testing mode | Manual | Auto-clear with configurable interval |
| CSF migration | N/A | One-click import tool |
| Active development | Slow | Active (2024+) |
or €8/month
5 specialized security plugins. Each works independently — no server required.
File integrity monitoring against official WordPress checksums. Malware detection with 62+ signatures. Vulnerability scanning. Quarantine management.
WordPress Application Firewall (WAF) with 7 rule categories. Security hardening checklist. HTTP security headers management.
User-Agent signature matching with 143+ patterns. Behavioral scoring engine. rDNS verification for good bots. Cloudflare-style inline controls.
Brute force protection with progressive lockouts. Two-factor authentication (TOTP). Honeypot for bots. Login attempt logging.
Comprehensive security event monitoring. Alert rules with email, Slack, and webhook notifications. GDPR-compliant data export/erasure.
WordPress plugins work great alone. With Server Edition, they're unstoppable.
WordPress blocks bad bots — Server blocks their IP at firewall level, protecting all sites on the server.
Login Guard detects brute force — Server locks the IP across ALL sites and services on the machine.
Activity Log tracks WordPress events — Server provides server-level timeline for complete visibility.
curl -fsSL https://vistoshield.com/install.sh | bash
Supported OS: Ubuntu 22.04+, Debian 12+, AlmaLinux 8+, CentOS Stream 9+
From Plugin Directory:
Plugins → Add New → Search "VistoShield"
Manual Install:
Download from our plugins page, upload the ZIP via Plugins → Add New → Upload Plugin.