Astrari Docs

Add any URL and start scanning externally — no agent, no DNS records, no plugin. SSL, headers, blacklists, email security, exposed files, and full WordPress CVE coverage.

Step-by-step guide to installing the Astrari agent on Linux servers. Covers requirements, the one-line install command, what gets installed, and how to verify everything is running.

Active probes that catch what file-based scanners miss — services bound to the wrong interface, unauthenticated Redis/Memcached, exposed .git or .env files, weak TLS on running services, default-path admin panels. Plus how to whitelist probes in your WAF and how to write custom rules.

The agent reads the security logs already on the host — sshd, sudo, lfd, fail2ban, firewall drops, maldet, root's mailbox — and ships hourly counters, never log lines. Ten rules catch a blocker that has stopped blocking, stale signatures, a failed control, a log gone silent. Includes the Prometheus /metrics endpoint.

Evidence for ISO 27001 A.8.15 and A.8.16 on the servers you opt in: a review queue of security-log events, Expected / Investigating / Escalated decisions, a weekly sign-off and a PDF + CSV evidence pack. Append-only, kept 13 months, no raw log lines.

Annex A controls and your own checklist, append-only evidence with a manifest hash, named sign-off with separation of duties, a weekly posture record, and expiring auditor links with a verifiable export pack.

On physical servers, the agent reads the server's own hardware sensors every 15 minutes — power supplies, fans, temperatures, memory errors, RAID arrays and disks — and reports faults as Hardware findings. Virtual machines are detected and skipped automatically.

Optional CrowdSec with an nftables firewall bouncer. Starts in Monitor, showing what would have been blocked; Protect applies time-limited bans with a safety cap and allowlists, and defers to fail2ban, LFD or cPHulk where they already cover a service.

The whole method behind the 0–100 number: severity weights, one bucket per package with the kernel family collapsed, diminishing returns, the 40% discount for CVEs nobody can patch in place, the separate hosted-sites layer that caps a server rather than zeroing it, and the hard floor for compromised systems.

Answers to common questions about how Astrari works — the scanners, WordPress site checks, finding management, SSH auto-fix, forensic diagnostics, alert routing, the Cloudflare edge integration, support, billing, and more.

Notable releases, improvements, and security-relevant changes. We ship continuously — this is the human-readable record of what's new and what's changed.

REST endpoints for sites, servers, findings, reports, and outbound webhooks. Includes the HMAC signing scheme for verifying webhook deliveries. Available on Professional and Agency plans.