01every 15 min
SSH
Password and root logins, empty passwords. The fix reminds you to add your key first.
BOXWARDEN
Server security monitoring for your own VPS
Know when your VPS is exposed or hacked
Before your host emails you about abuse. One line installs an open-source agent that checks SSH, open ports, vulnerable packages and signs of a break-in, and messages you the exact fix.
Free during beta · 5-minute setup · No card
8Checks
1 minResource sampling
0Ports the agent opens
AGPLOpen-source agent
Ubuntu · Debian · RHEL · AlmaLinux · Rocky · x86_64 and arm64
Why
How small servers actually get hacked
SSH with a password
Bots try root passwords around the clock. One weak password and the server is theirs.
Docker opens your database
ufw says the port is blocked. Docker writes its own firewall rules, so Postgres or Redis answers anyone.
Packages nobody updated
Exploits for old versions are public. Attackers scan the whole internet for them, not for you.
You find out last
A miner runs for weeks. You notice the CPU bill, or your host suspends the server for abuse.
What it checks
Eight checks, around the clock
Security every 15 minutes, resources every minute, vulnerabilities daily. Every finding comes with the command that fixes it.
02every 15 min
Accounts
A second root account, users without a password, SSH keys planted in www-data or redis.
03every 15 min
Files
System files any user can write: passwd, sudoers, cron, systemd units, root's PATH.
04every 15 min
Updates
End-of-life releases, kernel fixes waiting for a reboot, servers nobody has patched.
05every 15 min
Exposed
Databases, Docker API and admin panels open to the internet, even past ufw, even without a password.
06daily
Vulnerable
Known CVEs on the host and in containers, checked daily. Actively exploited (CISA KEV) first.
07every 15 min
Compromise
Miners, reverse shells, fake kernel threads, and anything new since your baseline: users, keys, cron jobs.
08every minute
Resources
CPU, memory, disk and traffic every minute. Alerts on disk-fill forecasts, OOM kills, unusual CPU and traffic spikes.
The dashboard
Every server on one screen
Who it's for
For teams whose security team is nobody
Indie developers
Your product runs on a VPS you set up once and never audited. Boxwarden is the second pair of eyes you don't have.
Small teams
Everyone ships, nobody owns security. Findings come with the fix, so whoever is on call can act in minutes.
Agencies
Servers for many clients, tagged by client. One dashboard and one alert channel instead of a dozen logins.
How it works
One line, then it watches
Sign in
With GitHub or email. Add a server and copy the one-line install.
Paste it as root
The installer checks the agent's checksum, connects the server and sets up systemd timers.
The agent checks
Security every 15 minutes, resources every minute, vulnerabilities daily. It only reads the system.
You get an alert
Critical and high at once, the rest in a daily digest: Telegram, Slack, Discord or your webhook.
curl -fsSL https://github.com/boxwarden/agent/releases/latest/download/install.sh | sudo sh -s YOUR_TOKENTelegram · Slack · Discord · Webhook
What an alert looks like
alertcritical crypto miner running: kdevtmpfsi, 390% CPUapi-prod
alerthigh postgres :5432 is open to the internet — Docker bypasses ufwapi-prod
alerthigh disk / will be full in about 5 hours at the current ratedb-1
alerthigh openssh has a vulnerability listed in CISA KEVdb-1
addednew SSH key in service account www-dataweb-2
removedfixed redis :6379 is no longer reachableapi-prod
Telegram · Slack · Discord · Any webhook (HMAC-signed JSON)
Not sure what a finding means? Claude explains it in plain words, with your own Anthropic key.
Compared to
Not another tool to babysit
Instead of running Lynis by hand
Lynis audits a server when you remember to run it. Boxwarden checks every 15 minutes and tells you when something changes.
Instead of operating a SIEM
Wazuh and similar platforms are built for security teams with a server to run them on. Boxwarden is one line and a chat.
Instead of uptime checks alone
An uptime monitor sees your server from outside. A server with a miner at 100% CPU still answers ping.
Alongside fail2ban
fail2ban blocks brute-force logins. It won't tell you Postgres is open to the internet or that a new root account appeared.
Trust
An agent you can read
Read-only
The agent never changes your system. Every fix is a command you run yourself.
No open ports
It only connects out. Boxwarden cannot send it commands.
Findings only
No files, logs or secrets leave the server — just what was found and where.
Open source
The agent is AGPL. Read every line, or run it without an account.
Signed releases
Built by GitHub Actions from a tag, with signed provenance. The installer checks SHA-256.
Updates when you say so
Nothing new runs as root until you decide. Then one line updates it, keeping its baseline.
Pricing
Free while in beta
Every check, the dashboard and every alert channel cost nothing during the beta. After it, Boxwarden moves to paid plans with a free trial. We will tell you well before anything changes, and the open-source agent stays free to run on its own.
Questions
Frequently asked
How do I know if my VPS has been hacked?
The usual signs: a process using 100% CPU that you don't recognise (often a crypto miner named like a system process), new users or SSH keys you didn't add, unfamiliar cron jobs or systemd services, and outbound traffic far above normal. Boxwarden checks for all of these every 15 minutes and compares the server with a baseline you approve, so a change shows up as an alert instead of a surprise.
Does the agent change anything on my server?
No. It reads configuration, packages, processes and sockets, and runs under systemd with a read-only filesystem. Fixes are commands you copy and run yourself.
What leaves my server?
Findings, the list of listening ports and resource numbers with the names of the busiest processes. Never file contents, logs, keys or passwords.
How is it different from Lynis, Wazuh or fail2ban?
Lynis audits a server when you run it; Boxwarden checks continuously and alerts you when something changes. Wazuh is a full SIEM you install and operate; Boxwarden is one line and a chat. fail2ban blocks brute-force logins; Boxwarden finds what fail2ban can't, like a database open to the internet or a new root account. Many people run Boxwarden alongside fail2ban.
Which servers does it support?
Any Linux with systemd on x86_64 or arm64: Ubuntu, Debian, RHEL, AlmaLinux, Rocky. The vulnerability scan covers Ubuntu and Debian hosts and Debian, Ubuntu and Alpine containers.
Where do alerts go?
Telegram, Slack, Discord, or any URL as signed JSON (n8n, Zapier, PagerDuty, your own script). Critical and high right away, the rest in a daily digest.
How do I update the agent?
Run the installer again without a token: curl -fsSL https://github.com/boxwarden/agent/releases/latest/download/install.sh | sudo sh. It keeps the connection and the baseline.
Can I use it without an account?
Yes. Download the agent from GitHub and run boxwarden scan. The account adds the schedule, history and alerts.
What if Boxwarden itself is breached?
The agent accepts no commands and opens no ports, so an attacker could read your findings but could not reach your servers through it.
How much does it cost?
Every feature is free while Boxwarden is in beta. After the beta it moves to paid plans with a free trial, and we will tell you well before anything changes.
Free during beta · 5-minute setup