CrowdSec
Intrusion prevention tool in Privacy & security
Blocks attacking IPs using crowdsourced reputation data; people run its free version as a simple WAF and free blocklists. Critics cite false positives and a source code leak.
Blocks attacking IPs using crowdsourced reputation data; people run its free version as a simple WAF and free blocklists. Critics cite false positives and a source code leak.
21 people gave an opinion
- recommend it
- 11
- criticize it
- 10
- approval share
- 52%
Recommended in 6 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: not recommended
- April 2026: not recommended
- May 2026: not recommended
- June 2026: not recommended
- July 2026: recommended
- August 2026: not recommended
- September 2026: recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 11 people recommend itNeeds 10 or more, met.
- 1.1 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 6 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Blocks bots and random scraping
“I use the free version as a simple WAF on multiple servers and it blocks a lot of bots.”
Comment from 17 Sep 2026 in “CrowdSec Source Code Leak” “Set up Crowdsec as WAF and subscribe to their free blocklists to filter out bots”
Comment from 6 Sep 2026 in “Cloud in a Bottle: making self-hosting accessible to everyone” “Cloudflare and or crowdsec can cover 99% of bot and traffic issues.”
Comment from 5 Jan 2026 in “Jeffgeerling.com has been Migrated to Hugo” - Comment from 11 Feb 2026 in “Thank You, AI”
Free version and free blocklists
“I use the free version as a simple WAF on multiple servers and it blocks a lot of bots.”
Comment from 17 Sep 2026 in “CrowdSec Source Code Leak” “Set up Crowdsec as WAF and subscribe to their free blocklists to filter out bots”
Comment from 6 Sep 2026 in “Cloud in a Bottle: making self-hosting accessible to everyone” Suggested as effective fail2ban-style tool
“something like fail2ban or crowdsec would probably be more effective here”
Comment from 15 Nov 2025 in “Messing with scraper bots” “set up something like CrowdSec”
Comment from 3 Jul 2026 in “Immich v3.0.0 Released”
What people warn about
Each mark is one comment
False positives block legitimate users
“The architecture is sound, but it ended up having an unacceptable false positive rate for us.”
Comment from 17 Sep 2026 in “CrowdSec Source Code Leak” “We had a lot of legitimate users end up blocked.”
Comment from 17 Sep 2026 in “CrowdSec Source Code Leak” Source code leak and undisclosed breach
“they didnt bothered to tell anyone about it since May until it the git was leaked and published”
Comment from 20 Sep 2026 in “TanStack supply-chain attack exposed ~170 private CrowdSec repos” “a security company leaking its own source code is quite the look”
Comment from 18 Sep 2026 in “CrowdSec Source Code Leak” “it seems like a reason for me to never use the vendor”
Comment from 17 Sep 2026 in “CrowdSec Source Code Leak” Costly SaaS tie-in
“Paying $1900/month for an IP address blocklist for a website? Yikes.”
Comment from 14 Jul 2026 in “Measuring Input Latency on Linux: X11 vs. Wayland, VRR, and DXVK” “rather than tie myself more tightly to their SaaS platform”
Comment from 17 Sep 2026 in “CrowdSec Source Code Leak”
What people recommend instead
The same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| fail2ban | 29 | 25 | 54% | 9 | — | — |
| CrowdSecThis page | 11 | 10 | 52% | 6 | — | — |
What people said
22 of the 24 comments that mention it, newest first. Each links to the original comment.
“they didnt bothered to tell anyone about it since May until it the git was leaked and published”
“a security company leaking its own source code is quite the look”
“I was going to register http://CrowdShite.com/ but somebody beat me to it.”
“internal ops are absolutely shit”
“it seems like a reason for me to never use the vendor”
“We had a lot of legitimate users end up blocked.”
“rather than tie myself more tightly to their SaaS platform”
“Every company on earth has had those, including every security company.”
“I use the free version as a simple WAF on multiple servers and it blocks a lot of bots.”
“It's quite a bit less expensive than most other commercial products of this kind that I've looked at.”
“Turns out they are not really a security company, just an aggregator of bad IPs.”
“The architecture is sound, but it ended up having an unacceptable false positive rate for us.”
“Set up Crowdsec as WAF and subscribe to their free blocklists to filter out bots”
“Paying $1900/month for an IP address blocklist for a website? Yikes.”
“We abandoned CrowdSec for that reason as well.”
“set up something like CrowdSec”
“Seems to deter a lot of random scraping.”
“Cloudflare and or crowdsec can cover 99% of bot and traffic issues.”
“appsec (by crowdsec), their proxy/gateway integration and your favorite firewall daemon”
“reputation data can be crowdsourced to block known bad bots”
“something like fail2ban or crowdsec would probably be more effective here”
“Not sure crowdsec is fit for this purpose. Its more a fail2ban replacement than a ddos challenge.”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.