The CAPTCHA bargain - annoy your users and feed their behavior to Google - gets replaced with economics by mCaptcha. Instead of image puzzles, it uses SHA256 proof-of-work: every visitor's browser silently solves a small computational challenge (via a WebAssembly library) before submitting a form. Humans never notice the milliseconds; bots hammering your site must burn more compute sending requests than your server spends answering them, which makes attacks more expensive than defense - the property that also makes mCaptcha genuine DoS protection, not just bot filtering. Written in Rust, the system is fully automated: difficulty scales with traffic, so challenges stay trivial in normal conditions and harden under attack. The privacy and accessibility wins are structural rather than promised: no tracking, no profiling, no user-pattern data collection, and no visual puzzles that exclude users with visual or cognitive impairments - the design was published in Communications of the ACM. Rate limiting is IP-independent, so users behind NATs, VPNs, or Tor get the same experience instead of endless challenge loops, and proofs resist replay attacks, neutering captcha farms. Migration is deliberately easy: the API is compatible with reCAPTCHA and hCaptcha, making it a drop-in replacement. AGPL-licensed core with proprietary-friendly client libraries.

CAPTCHAs make every visitor solve a puzzle to prove they are human; Mosparo takes the opposite route and checks the submitted content itself, no challenges, no image grids, and no tracking cookies. Drop the customizable checkbox widget into any form and Mosparo inspects each field separately, scoring the entry against your rules the way an email spam filter scores a message. Build field rules for banned words, domains, email addresses, IP addresses and subnets, providers, Unicode blocks, user agents, and websites, each with its own rating weight, or subscribe to shared rule packages that refresh themselves automatically. Every submission lands in an admin inbox with its spam rating, IP address, and verification status, and dashboard charts show valid versus spam traffic plus delayed or blocked requests over time. Legitimate users notice nothing but a plain checkbox, which stays fully usable with assistive technology, while everything Mosparo stores is encrypted and automatically deleted after 14 days. Run one instance for many sites with separate projects, project groups, and member roles, and connect your forms over the documented API from any stack that can send an HTTP request. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Anubis is a self-hosted web firewall that stands in front of your website and makes suspicious visitors complete a lightweight challenge before their requests are allowed through. Place it between your load balancer or TLS terminator and the application it protects, with one instance guarding each service. Requests that look like scraper bots are weighed and challenged, which raises the cost of mass crawling so automated harvesting stops being free. Requests that pass are forwarded straight to your target service over TCP or a Unix domain socket, so legitimate visitors reach the real site. You define the bot policy: allowlist known good bots and crawlers you want to keep, challenge the ones you are unsure about, and turn away the rest. Challenge difficulty and weight thresholds tune how hard visitors must work, letting you balance protection against friction for real readers. The server listens on port 8923 by default and exposes Prometheus metrics on port 9090, so request and challenge rates show up in your existing monitoring. Deployment is a single Docker image or native package with minimal resource needs, and configuration arrives through environment variables plus the policy file. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Hand-editing nginx configuration files to run a firewall is nobody's idea of a good afternoon, and Nginx-Love turns that chore into a dashboard. You manage domains, load balancing upstreams, and HTTPS backends through forms instead of config syntax, and the platform writes and reloads the underlying configuration for you. A ModSecurity firewall with the OWASP Core Rule Set inspects traffic to your sites, and you tune its rules from the interface rather than a text editor. Certificates arrive two ways: automated through Let's Encrypt, or uploaded manually when you bring your own. A Bot Manager fingerprints visitors with JA4 signals so you can welcome good crawlers, challenge suspicious automation, and block hostile bots by policy. Access lists filter by IP address, geography, and user agent, and multi-user roles let administrators, moderators, and viewers each see the controls appropriate to their job. Monitoring watches performance and attack patterns, sending alerts by email or Telegram when something needs attention. Configuration exports back up your setup, restores bring it back, and multi-node sync keeps a cluster of servers enforcing the same policy. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

tirreno watches what accounts actually do inside your product, then surfaces the ones that look like account takeover, credential stuffing, fake signups, or insider abuse. Your backend reports events such as logins, registrations, page views, searches, email changes, and field edits through an SDK or one HTTP call, and a scheduled job turns them into per-user context: devices, IP addresses, sessions, and connected identities. Preset rules cover account takeover, credential stuffing, content spam, bot detection, multi-accounting, promo abuse, dormant accounts, API protection, and high-risk regions, and you can add rules of your own. Each rule adds to a risk score, and thresholds decide whether a user is flagged for manual review or suspended automatically. The review queue lists who needs a look, and the single user view shows behaviour patterns, risk scores, connected identities, and an activity timeline. A field audit trail records what changed and when, which supports compliance reviews, while the logbook lists every API request the instance received. Your application can ask a blacklist endpoint whether a user or IP should be blocked before it responds. An optional IP enrichment pack adds geolocation, ISP, and VPN or proxy detection. All event data stays on your own server. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Leave a fake door unlocked and see who walks through: Krawl is a self-hosted honeypot that poses as a sloppy web server and records everything scanners and scrapers try. Fake WordPress, phpMyAdmin, and admin logins. Every attempt logged, every credential captured. A .env file leaking fake database strings, AWS keys, and Stripe secrets. SQL injection, XSS, path traversal, XXE, and command injection traps that answer with believable fake output. SQLMap gets a different database error on every request. Malicious crawlers wander an endless maze of random links. An optional tarpit adds delay and word salad that cost scrapers time, storage, and tokens. Optional AI-generated pages write a plausible decoy for any path an attacker requests. A hidden dashboard shows an attacker map, top IPs, captured credentials, and per-IP forensics. TLSH fuzzy hashing groups webshell variants into campaigns. A behavior score labels each IP attacker, bad crawler, good crawler, or regular user. Export bans as raw lists, iptables, or nftables rules, with guides for Fail2Ban, OPNsense, and RouterOS. A canary-token link in decoy pages emails you the IP and user agent of anyone who follows it. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Gately keeps your domain names current, forwards ports, terminates HTTPS, and blocks hostile traffic from one admin console, so a server or home network needs no pile of separate gateway tools. Dynamic DNS updates records at Cloudflare, Alibaba Cloud, Tencent Cloud, DNSPod, Huawei Cloud, Route 53, OVHcloud, Gandi, Namecheap, DuckDNS, and other providers, finding the public address over IPv4 or IPv6 by URL, network interface, or command. Port forwarding relays TCP and UDP with port ranges, failover targets, connection limits, traffic statistics, and PROXY protocol, while SNI routing lets several services share port 443. Certificates are issued and renewed through ACME with DNS-01 wildcards or HTTP-01, then pushed to other hosts over SSH. Web services add per-domain reverse proxies, redirects, and static sites with HTTP/3, WebSocket, load balancing, health checks, rate limiting, caching, and sign-in through OIDC, GitHub, Google, or TOTP-protected shared users. A WAF running the OWASP Core Rule Set and fail2ban-style jails with trap ports and nftables bans guard the edge. Manage Docker containers and Compose projects with one-click upgrades and rollback, open SSH sessions with an SFTP file manager, run ping, traceroute, and speed tests, and receive alerts in Telegram, Discord, Slack, ntfy, or email. An audit log, config history with diff and rollback, encrypted backups, scoped API tokens, and Prometheus metrics round it out. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

With over 14,000 GitHub stars and a growing global network of security deployments, CrowdSec turns every attack on any participating server into protection for the entire community. The security engine operates as a combined IDS/IPS and WAF, analyzing log sources from Nginx, Apache, SSH, WordPress, and over 50 other services to detect brute force attacks, port scans, web vulnerability exploitation, and credential stuffing in real time. When one server detects a new threat, the attacker's IP is shared through the community blocklist, proactively protecting thousands of other installations before the attacker can reach them. The built-in WAF powered by Coraza v3 inspects HTTP requests at the application layer, validates against OpenAPI schemas, and applies custom rules with flexible AND/OR condition mixing for precise threat detection. Bot detection serves challenge pages with client fingerprinting to distinguish legitimate traffic from automated scrapers and scanners. Remediation components block malicious IPs at multiple infrastructure layers including iptables, nftables, Nginx, HAProxy, Cloudflare, and AWS Security Groups through the detect-here-remedy-there architecture. The scenario-based detection system ships with default rules for common attack patterns and supports custom scenarios written in YAML with an expressive filter language. A centralized console provides real-time visualization of alerts, threat intelligence analysis, and management of multiple distributed security engines. GDPR compliant by design, all log analysis happens locally and raw logs never leave your infrastructure. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Input is a no-code form builder you host yourself, so the forms your customers answer and the data they submit stay on your infrastructure instead of a form vendor's cloud. Build in the drag-and-drop workbench by stacking blocks: short and long text, email, phone, number, date, checkboxes, multiple choice, rating, scale, file upload, link, secret, and consent fields, fifteen types in all. Conditional logic shows or hides blocks based on earlier answers, so a form can branch like a conversation instead of interrogating everyone with every question. Style the result in your brand colors and fonts until it looks like part of your site, then embed it on any page or share it directly. Respondents get a responsive form that adapts to desktop, tablet, and mobile, in multiple languages when your audience needs them. Submissions collect into a table view with one row per response and a summary view that charts choice distributions, common text answers, averages, and rating ranges, and everything exports to CSV for analysis elsewhere. Webhooks fire each submission as JSON to your other tools, with simplified setup for Make, and a custom completion page closes the loop with your message or a redirect. Consent fields and encrypted storage keep GDPR duties manageable, and unlimited forms and responses come standard because the server is yours. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

With 3,500+ GitHub stars and 100+ pre-built templates, OpnForm delivers a drag-and-drop form builder that handles everything from simple contact forms to multi-page surveys with conditional branching, calculations, and payment collection. The Laravel 11 API paired with a Nuxt 3 Vue frontend provides a responsive no-code editor supporting 20+ field types including text, date, file upload, signature capture, star ratings, phone numbers with country codes, and rich text. Conditional logic enables dynamic show/hide rules, required-field toggling, and calculated values that react to user input in real time. Submissions flow through configurable integrations — Slack notifications, Discord webhooks, Zapier connections to 5,000+ apps, Google Sheets sync, and custom webhook endpoints with full payload control. AI-powered form generation lets users describe a form in plain language and receive a ready-to-publish result. OIDC single sign-on with configurable state enforcement secures multi-user workspaces, while form-level passwords and CAPTCHA protection guard public-facing pages. Analytics dashboards track submission rates, completion times, and drop-off points. Forms embed via iframe on any website, Notion page, or custom domain with removable branding and custom CSS/JavaScript injection. The Docker Compose stack bundles the API, queue worker, scheduler, Nuxt client, PostgreSQL 16, Redis 7, and Nginx ingress proxy for a single-command deployment. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPLv3 licensed.