What Is CrowdSec? Attack Detection and Blocking, Setup, Is It Free, WordPress and Data Sharing
You install CrowdSec on your server; it detects attack behavior such as brute force and scanning from your logs, and shares bad-IP information collected by other users. It's an open-source (MIT) security tool. An important detail: the Security Engine doesn't block anything on its own; to block, you need to install a separate remediation component (bouncer). The core is free, and the Console web dashboard has a free Community plan. Users who send signals regularly get a larger community list. There's a free plugin for WordPress.
- What it does
- Detects attacks on your server and shares bad IPs
- Free
- Yes; MIT, Console Community
- Blocks on its own?
- No; it needs a bouncer
- Data sharing
- Signal metadata (including IPs) is shared
- No-code
- No; server setup
What Is CrowdSec Used For? Why Doesn't It Block on Its Own?
CrowdSec has two parts. The Security Engine reads your server's logs and detects attack behavior such as brute-force password attempts, port scans and web scans. The remediation component (bouncer) is what actually blocks the detected IP, at layers such as the firewall, Nginx, Traefik, HAProxy or Cloudflare. On top of that, bad IPs that users report to each other are collected in a community blocklist.
!The official installation page says it clearly: the Security Engine on its own is a detection engine and doesn't block anything. To block, you have to install a remediation component; this is usually the reason when people install CrowdSec and see that no IPs are being blocked.
Who it's for: developers and system administrators who run their own VPS or server; people who want to protect a WordPress site from malicious traffic.
How Do You Install CrowdSec? Does It Work with WordPress?
- Add the repository:
curl -s https://install.crowdsec.net | sudo sh - Install the engine on Debian/Ubuntu:
sudo apt install crowdsec - To block, install a remediation component: for a web application, for example crowdsec-nginx-bouncer; for non-web services such as SSH, crowdsec-firewall-bouncer-iptables.
- After installation, move on to the steps on the official Stack Health-Check and Post Installation Steps pages.
Download and run the MSI installer from the GitHub releases page, or use choco install crowdsec. For blocking, the Windows Firewall component is also needed, and it requires the .NET 6 runtime.
The free plugin works in two ways: connecting to a reachable CrowdSec server, or running without a Security Engine using a blocklist from the CrowdSec Console (no AppSec in this mode). Which one works on shared hosting isn't stated in the official documentation. The plugin only catches requests that go through WordPress; for static files, you need to block access with a server rule.
!If apt looks like it's going to install an old version such as 1.4.6, the official page says the package isn't up to date (on Ubuntu ESM/Pro you may need to set package priority). The latest release is v1.8.1 (September 3, 2026).
Is CrowdSec Free? Console, Community Blocklist and Pricing
- Detection engine (MIT)
- Participation in the community blocklist
- Blocking on its own
- First 500 alerts a month
- 2 months of retention, 1 user
- Up to 3 blocklists
- Custom quota and longer retention
- Unlimited blocklist subscriptions
- Custom quota, up to 1 year of retention
- Premium community blocklist
Free users who send signals regularly get the large Community list, and those who don't get the small Lite list; paid users get the Premium list even if they don't send signals. The list size is given differently on three official documentation pages (for example 3 thousand, 15 thousand, 50 and 60 thousand IPs), so no number is given here. There are also paid products: the IP reputation API from $49/month (5,000 queries) and Platinum blocklists from $1,900/month (SMB). The price of Console Premium isn't published anywhere. Prices are in dollars; there's no Turkish lira price or VAT information; you can cancel the plan anytime (effective at the end of the month).
The software is MIT-licensed and free to use in commercial projects. However, embedding CrowdSec data (blocklists) in your own product for commercial use requires a Partnership Program subscription.
Official pricing page last checked on .
What Data Does CrowdSec Share?
What's shared isn't “attack details” but signal metadata: the scenario name, time, machine ID, and the attacker's IP address and location. You turn it off with the online_client.sharing setting; but because the free community list depends on contributing, those who don't send signals get the smaller Lite list.
According to the privacy page, attacker IPs are stored as-is for up to 3 months; after that, IP precision and time resolution are gradually reduced. There's a correction/deletion request for anyone who thinks an IP has been wrongly linked to an incident.
CrowdSec isn't an AI model; however, the privacy page says IP signals may also be stored to train learning engines. The privacy page mentions only GDPR; it says nothing about KVKK (Turkey's Personal Data Protection Law) compliance. The steps for deleting a Console account aren't clear in the official sources.
Frequently asked questions
What is CrowdSec and what does it do?
An open-source security tool that detects attack behavior in server logs, blocks bad IPs and shares a community blocklist.
Is CrowdSec free?
Yes: the Security Engine is MIT-licensed, and the Console has a free Community plan (500 alerts a month, 3 blocklists). The Premium Console price isn't published.
I installed CrowdSec but no IPs are being blocked. Why?
The Security Engine on its own only detects. To block, you have to install a remediation component (for example a firewall or Nginx bouncer).
Does CrowdSec work with WordPress?
Yes, there's a free plugin. It can connect to a reachable CrowdSec server or use a Console list. Which one works on shared hosting isn't stated.
What data of mine does CrowdSec share?
Signal metadata: the scenario name, time, machine ID, and the attacker's IP address and location. Sharing can be turned off in the settings, but on the free plan you then get a smaller community list.
Is CrowdSec KVKK compliant?
The privacy page mentions only GDPR; there's no statement specific to KVKK (Turkey's Personal Data Protection Law).
Related guides
Sources
- CrowdSec Linux installation
- CrowdSec pricing
- Community blocklist
- Console quotas
- WordPress plugin
- CrowdSec GitHub
Not clear in the official sources: Console Premium pricing · Turkish lira pricing, VAT and student discounts · a Turkish interface · whether it works on shared hosting · deleting a Console account · KVKK compliance · bouncer licenses and fees. The community list sizes contradict each other across three documentation pages. Each one is covered in its section, along with what you can do.