Recommended Free Tools
The reliable way to reduce malicious scans is to use three layers together: nginx rejects requests that should never be public, nginx rate limits abusive request bursts before they reach your application, and fail2ban converts repeated bad behavior in nginx logs into temporary firewall bans. Each layer addresses a different failure mode; none is a substitute for patching the operating system and application.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Start by allowing only the ports you actually serve, whitelist your administration address, and test every rule from a second address before enabling long bans. User-agent blocking is useful as a low-effort filter, but it is not an identity check because scanners can change their user-agent string.
As an Amazon Associate I earn from qualifying purchases.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhat these controls can—and cannot—stop
Internet-facing servers will receive automated requests for exposed configuration files, source-control directories, old software paths, login endpoints and known vulnerabilities. You cannot make a public HTTP service invisible to every scanner. You can, however, make common probes fail quickly, slow automated guessing, and remove repeat offenders at the firewall.
The controls operate at different points in the request path:
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| Layer | Where it acts | Good at | Main limitation |
|---|---|---|---|
| nginx filtering | HTTP request handling | Rejecting dotfiles, source-control paths, obvious probe URLs and known scanner user agents | User-agent strings are easy to spoof; a rule only covers the paths and patterns you write |
nginx limit_req |
Before application handlers run | Reducing bursts and slowing login or API abuse on a per-IP basis | A shared NAT address can represent many legitimate users; distributed scans use many IPs |
| fail2ban plus firewall | Host firewall, after log evidence exists | Temporarily blocking IPs that repeatedly trigger scanner, rate-limit or error conditions | It needs correct log paths, filters and firewall actions, and it can ban legitimate clients |
Use the first layer for deterministic requests, the second for traffic volume, and the third for repeat behavior. Keep application patching, strong authentication and least-privilege file permissions as separate requirements.
Prepare safely before changing nginx or fail2ban
- Confirm how traffic reaches the host. If a reverse proxy or load balancer terminates TLS, nginx may see the proxy address rather than the visitor address. Do not rate-limit or ban that shared proxy address unless your real-client-IP configuration is already correct.
- Record your administration address. Use the public IP from which you will test SSH and the website. If you administer through a VPN, record the VPN egress address as well. A changing residential address should not be placed in a permanent whitelist without a recovery plan.
- Back up configuration files. Save the active nginx configuration and any existing fail2ban files before editing. A syntax error can stop a reload; a bad ban can cut off your own access.
- Check the active nginx configuration. Run
sudo nginx -tbefore every reload. Only apply a reload after the test reports a valid configuration. - Keep an out-of-band recovery path. Console access from your hosting provider or a second administrator is valuable if a firewall rule blocks SSH.
Block dotfiles and obvious probe paths in nginx
Files and directories beginning with a dot commonly contain deployment secrets or repository metadata. A web server should not serve .env, .git, editor swap files or similar paths. The examples below return HTTP 403, which makes the denial explicit and is easy to verify in logs.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Protect hidden files while leaving the ACME directory available
# Put this inside the server {} block for the site
location ~ /.(?!well-known) {
return 403;
}
# Explicit rules for the two highest-value targets
location ~* ^/(?:.env|.git)(?:/|$) {
return 403;
}The negative lookahead leaves /.well-known/ available for certificate-validation files. If your site does not use that directory, deny it too. Check that your application does not intentionally expose another hidden path before applying a broad rule.
Drop requests for unused login and scanner paths
Only reject a URL when you know the application does not need it. A WordPress installation, for example, may legitimately use /wp-login.php; a non-WordPress site can reject it. Return code 444 is an nginx-specific “close without a response” action. It saves response work but is not an HTTP status that clients can rely on.
# Use only for paths that are not part of your application
location ~* ^/(?:wp-login.php|xmlrpc.php)$ {
return 444;
}Do not use a blanket rule for every unfamiliar URL. Applications often have health checks, webhooks and versioned API paths that look unusual to a generic scanner.
Match common scanner user agents as a low-cost filter
Define the map in the http context, not inside a server block:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
map $http_user_agent $is_known_scanner {
default 0;
~*(sqlmap|nikto|nmap) 1;
}Then add this to the relevant server block:
if ($is_known_scanner) {
return 444;
}This catches clients that identify themselves with those strings, but it does not identify software reliably. A scanner can send a normal browser user-agent, and a security team may use one of these tools legitimately. Keep the list short, monitor false positives and rely on IP-based evidence for sustained bans.
Reload and verify the filter
- Place the
mapin the main nginx configuration’shttpsection and thelocationrules in the intended virtual host. - Run
sudo nginx -t. Correct every reported file and line before proceeding. - Reload with
sudo systemctl reload nginx. - From an address that is not your administrative whitelist, request a protected path and check the result:
curl -i https://SERVER/.envshould receive 403, while a request with a test user-agent such ascurl -i -A sqlmap https://SERVER/should close without a normal response. - Review the access and error logs to confirm that the intended virtual host handled the request.
Rate-limit requests before they reach the application
nginx’s limit_req module tracks request rates in shared memory. A zone keyed by $binary_remote_addr gives each client IP its own counter and applies the limit at the web-server layer.
Create separate general and login zones
Add the zones in the http context. The rates below are starting points, not universal safe values: adjust them to the normal request pattern of your site.
limit_req_zone $binary_remote_addr zone=general_per_ip:10m rate=5r/s;
limit_req_zone $binary_remote_addr zone=login_per_ip:10m rate=1r/m;The shared-memory size determines how many client keys nginx can retain; it is not a bandwidth allowance. A higher rate permits more requests, while a lower rate is more restrictive.
Apply the general limit and a stricter login limit
server {
# Baseline protection for this virtual host
limit_req zone=general_per_ip burst=20;
location = /login {
limit_req zone=login_per_ip burst=5 nodelay;
proxy_pass http://application_backend;
}
}Replace /login with the exact login endpoint used by your application. If it has several methods or aliases, cover each deliberately. A small burst absorbs short, legitimate bursts; nodelay rejects excess requests immediately rather than queuing them. Remove nodelay if a short queue is preferable to immediate failures.
Choose limits without locking out real users
- Measure normal page loads, API clients and monitoring checks before setting a threshold.
- Remember that a school, office or mobile carrier may put many users behind one public IP. A limit that is safe for a single home user may be too low for shared NAT.
- Keep login limits materially tighter than general browsing limits, because password guessing is expensive even when each request is small.
- Return behavior and status codes should be observed in your own nginx version; published examples differ in whether they customize the limit response.
After editing, run sudo nginx -t, reload nginx, then issue a controlled series of requests from a non-whitelisted address. Record when the limit begins to reject or delay requests and tune before enabling automated bans.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Use fail2ban to ban repeat offenders
fail2ban watches log lines, counts matches inside a time window and asks a firewall action to block the source IP for a defined period. It is most useful after nginx has produced a clear signal: a known scanner pattern, repeated rate-limit events or an abnormal number of 403/404 responses.
Install and start the service
# Debian or Ubuntu family
sudo apt update
sudo apt install fail2ban
sudo systemctl enable --now fail2ban
# Fedora, RHEL or compatible distributions
sudo dnf install fail2ban
sudo systemctl enable --now fail2banPackage names and service defaults vary by distribution. Do not edit the vendor-supplied jail.conf; create or edit /etc/fail2ban/jail.local so upgrades do not overwrite your settings.
Free tools Windows power users keep installed
One-click scans. No signup required.
Set conservative defaults and an explicit nginx log path
nginx normally writes flat files such as /var/log/nginx/access.log and /var/log/nginx/error.log, rather than sending these entries to the systemd journal. Set the path for every enabled jail. If your distribution globally selects a systemd backend, nginx jails may need backend = polling to read those files.
[DEFAULT]
findtime = 10m
maxretry = 5
bantime = 10m
backend = polling
ignoreip = 127.0.0.1/8 YOUR.ADMIN.IP
banaction = iptables-multiport
[nginx-botsearch]
enabled = true
port = http,https
logpath = /var/log/nginx/access.log
maxretry = 2
bantime = 3d
[nginx-limit-req]
enabled = true
port = http,https
logpath = /var/log/nginx/error.log
maxretry = 5
findtime = 10m
bantime = 30mReplace YOUR.ADMIN.IP with the address you actually use; keep the replacement inside the configuration, not as a literal placeholder. The names nginx-botsearch and nginx-limit-req are commonly supplied filters, but available jails and their regular expressions vary by fail2ban release and distribution. Confirm that each filter file exists before enabling it.
Add a high-404 jail only after validating its regex
A high-404 jail can identify an IP that requests many nonexistent or forbidden paths in a short period. It is more prone to false positives than a scanner signature: broken links, vulnerability testing and a misconfigured client can all produce 404 responses. Use a separate jail with a short initial ban, and test its filter against real access-log lines with fail2ban-regex. If your package does not provide an nginx 404 filter, create one only after confirming your log format and the exact status-field placement.
Do not copy a regular expression from an unrelated nginx log format. Combined logs, JSON logs and proxy-added fields require different expressions. A filter that matches nothing provides no protection; one that matches every line can ban your users.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Choose the firewall action that your host actually uses
iptables-multiport remains a common default. Newer systems using nftables may provide an nftables-multiport action instead. Check the installed action files and the distribution’s firewall framework before selecting one. A syntactically valid jail with an unavailable action will log failures without enforcing bans.
After editing jail.local, restart fail2ban and inspect each jail:
sudo systemctl restart fail2ban
sudo fail2ban-client status
sudo fail2ban-client status nginx-botsearch
sudo fail2ban-client status nginx-limit-reqThe status output should show the filter, log path, current failed count and currently banned IPs. If a jail fails to start, read sudo journalctl -u fail2ban for the configuration error, then verify the filter file, log path and firewall action.
Know how to unban an address
Keep the recovery command available before turning on long bans:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo fail2ban-client set nginx-botsearch unbanip 198.51.100.25Use the jail that actually contains the ban. If the address is present in more than one jail, unban it from each one. Whitelisting your own address with ignoreip is safer than relying on emergency unban access, but it does not protect a different administrator who connects from another network.
Restrict the host firewall to required ports
Web-layer rules still allow unwanted packets to reach the host. A host firewall should expose only services you operate. For a typical web server, that means SSH, HTTP and HTTPS; use your actual SSH port if it is not 22.
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verboseApply equivalent rules with the firewall framework used by your distribution if UFW is not installed. Confirm IPv6 policy separately if the server has an IPv6 address. Never enable a default-deny policy until you have allowed your management path, or you may lose SSH access.
Test the complete stack without banning yourself
- Test deterministic nginx denials. Request a harmless protected path such as
/.envfrom a non-whitelisted network and confirm the expected 403 or configured close behavior. - Test the user-agent rule. Send a request with the test string used in your map. Confirm the connection behavior and verify that nginx logged the event as expected.
- Test rate limiting. Send a controlled burst from one test IP, not from your office’s shared address. Record response codes and confirm that normal browsing from another address remains unaffected.
- Test each fail2ban filter offline. Run
sudo fail2ban-regex /var/log/nginx/access.log /etc/fail2ban/filter.d/FILTER.confwith the actual filter filename. Review matched and missed lines before enabling a jail. - Test a short ban. Temporarily use a brief
bantime, generate only enough matching events to trigger it, and confirm the IP appears infail2ban-client status JAIL. - Test recovery. Unban the address with
fail2ban-client, then verify that the firewall rule disappears and access returns.
Troubleshoot the failures that matter most
Requests are denied but the application needs them
Check the most specific nginx location first. A broad dotfile expression or probe rule may be matching an application route, an ACME challenge or a webhook. Narrow the expression, move the exception into an explicit location and reload only after nginx -t succeeds.
Rate limiting affects many legitimate users
Look for shared NAT, mobile carrier addresses, health checks or a reverse proxy whose address is being used as the key. Correct real-client-IP handling where appropriate, increase the zone rate or burst, or apply the strict zone only to the sensitive endpoint. Do not solve false positives by disabling all limits.
fail2ban shows no matches
- Confirm nginx is writing to the path in
logpathand that the service account can read it. - Check whether the jail expects access-log lines or error-log lines. Rate-limit messages generally appear in the error log.
- Run
fail2ban-regexagainst a captured line from your server, not an example copied from another log format. - Inspect the jail status and fail2ban service log for a typo in the filter name, backend or action.
fail2ban reports bans but traffic continues
Verify the selected action matches the host’s firewall backend and that the blocked address is the actual client address. A proxy address, container network or IPv6 address can make an apparently successful ban ineffective. Check the firewall’s active rules directly and confirm whether traffic is arriving over IPv4 or IPv6.
You locked yourself out
Use the console or another trusted network to remove the ban, then add the correct administration address to ignoreip. Review which jail matched before increasing thresholds or ban times.
Tune ban times and maintenance rules
Match the penalty to the evidence. A rate-limit event may deserve a short ban—minutes rather than days—because a legitimate burst can look abusive. A confirmed scanner pattern can justify a multi-day ban, provided the filter has a low false-positive rate. Start conservatively and extend bans only after reviewing real logs.
Review the configuration after nginx, fail2ban or the operating system is upgraded. Filter names, action names and default regular expressions can change between releases. Keep a record of your nginx log format, firewall backend, whitelisted addresses and the exact commands used to unban an IP.
Finally, treat reduced scan noise as an operational benefit, not proof that the server is secure. Continue applying security updates, remove unused services, protect real login endpoints with strong authentication and monitor application errors. Scanners that are blocked at nginx can still be replaced by other IPs, and a vulnerability that accepts a valid request will not be fixed by a probe filter.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
