How brute-force protection works on your instance
SFTPGo's built-in defender counts failed logins, rate-limit violations, and abusive connections per client IP and blocks offenders automatically for a time window you or support configure. On DANIAN instances the reverse proxy is accounted for, so bans land on the real client address, not the proxy.
SFTPGo's built-in defender counts failed logins, rate-limit violations, and abusive connections per client IP and blocks offenders automatically for a time window you or support configure. On DANIAN instances the reverse proxy is accounted for, so bans land on the real client address, not the proxy.
The defender works on all protocols at once: SFTP, FTP, FTPS, WebDAV, and the web interfaces. A partner who mistypes a key twice is never blocked; a scanner hammering port 2023 disappears mid-attempt. Blocked addresses age out automatically, and the block list is visible through the REST API so you can audit it.
If a partner reports being blocked after a misconfigured automation, ask support to clear the address. To tighten or relax thresholds for a specific workflow, for example a partner with a script that retries aggressively, the thresholds can be adjusted per instance in the service configuration.
