andrisoft.com

Cybersecurity is the practice of keeping your data, accounts, and services from being accessed, stolen, altered, or knocked offline by someone who shouldn't have them. For a personal site or small online presence, that reduces to a short list of concrete jobs: protect your login credentials, keep your software current, serve traffic over HTTPS, and lock down the domain and DNS layer that everything else depends on. You don't need an enterprise security team to cover the basics — but you do need to treat your registrar account and your hosting account as the two most valuable things you own, because whoever controls those controls the site.

What cybersecurity actually protects

It helps to separate the assets from the threats, because most small-site incidents come from a handful of causes.

The pattern: each asset has one or two controls that remove most of the risk. You don't need all of them on day one, but skipping the account and domain layers is the mistake that's hardest to undo.

The threat categories a small site actually faces

• Credential theft — reused or weak passwords, or credentials leaked from another breached service. This is the most common way small sites fall.
• Phishing — fake login pages or "your domain is expiring" emails designed to capture your registrar or hosting password.
• Malware and backdoors — usually arriving through an outdated CMS, plugin, or theme.
• DDoS — flooding a site until it's unreachable; often handled by your host or a CDN rather than by you.
• Misconfiguration — an open admin panel, directory listing, or default credentials left in place.

Notice that four of the five are about access, not exotic exploits. That's why the basics work.

Core protections to apply first

Use strong, unique passwords and a password manager

Every account tied to your site — registrar, host, CMS, email — should have a different password. A password manager makes this practical. The goal is that one leaked password can't be replayed anywhere else.

Turn on multi-factor authentication

MFA is the single highest-value control for your registrar and hosting accounts. Even if a password is stolen, an attacker without the second factor can't log in. Prefer an authenticator app or hardware key over SMS where the service supports it.

Serve everything over HTTPS

An HTTPS/TLS certificate encrypts traffic between visitors and your site and prevents browser "not secure" warnings. Most hosts and registrars offer a free certificate; the important part is that it's installed and that HTTP redirects to HTTPS.

Update promptly and keep the surface small

Apply CMS, plugin, and theme updates as they're released, and delete anything you're not using. Fewer components means fewer places for a known vulnerability to sit unpatched.

Apply least privilege

Give each person (and each integration) only the access they need. Don't run your site day-to-day from an administrator account, and don't hand out admin rights for tasks that don't require them.

Secure the domain and DNS layer

This layer is easy to overlook and expensive to lose, because a hijacked domain can point anywhere.

• Protect the registrar account with a unique password and MFA. Your registrar account is the root of control over the domain.
• Enable the registrar lock (often called a transfer lock or clientTransferProhibited) so the domain can't be moved without your action.
• Keep registrant contact email secure — that inbox is often the recovery path for the domain.
• Enable DNSSEC where your registrar and DNS provider support it, so responses can be cryptographically validated and spoofing is harder.
• Watch for unauthorized DNS changes — if records you didn't touch appear, treat it as a compromise.

Porkbun is an ICANN-accredited domain registrar, which means it operates under ICANN's registrar rules — relevant here because those rules govern transfers, locks, and registrant contact requirements. Its site lists Stripe among its payment platforms. Beyond that, check your specific registrar's and DNS provider's current feature set for lock and DNSSEC support, since availability varies.

Warning signs and first steps if something looks wrong

Watch for: unexpected DNS records, visitors reporting malware warnings, unexplained admin accounts, a sudden traffic drop, or emails about transfers you didn't request.

If you suspect a compromise:

1. Change passwords on registrar, hosting, and CMS accounts, starting with the registrar.
2. Revoke active sessions and reset MFA where possible.
3. Check DNS records against what you expect and revert unauthorized changes.
4. Restore from a known-good backup if files were altered.
5. Re-scan and update the software before reopening the site.

Containment first, then recovery — don't try to clean a live, still-compromised site.

What to outsource vs. manage yourself

Hosting-level security, CDN, and WAF are usually worth outsourcing because they require scale and constant attention. Account hygiene, MFA, updates, and domain/DNS protection are things you should keep in your own hands regardless of size — they're cheap to do and costly to skip.

Andrisoft is an EU-based software vendor, active since 2006, that builds on-premise network security and traffic-monitoring software for network operators. Its two products are Wanguard (DDoS detection and mitigation) and Wansight (traffic monitoring and accounting). Both ship as Linux packages that run on your own servers rather than as an appliance placed in the traffic path, and the company says it serves 1,000+ network operators in 50+ countries. If you want DDoS defence or flow-level visibility that stays inside your network and avoids per-gigabit fees, this is the category of tool to evaluate.

The two products

Wanguard — DDoS detection and mitigation

Wanguard is the flagship. Its Sensors watch NetFlow, sFlow, IPFIX, or mirrored packets, and anomaly checks run every second, so detection is measured in seconds. Mitigation happens on your own network in one of two ways:

• On your routers — via Flowspec or RTBH (remotely triggered black hole).
• On Linux filtering servers — dedicated Filters scrub diverted attack traffic at line rate.

The current release listed on the site is 9.0 (July 2026).

Wansight — traffic monitoring and accounting

Wansight uses the same Sensors and Console but without detection and mitigation. It provides bandwidth graphs for hundreds of thousands of IPs, top talkers, flow and packet forensics, and 95th-percentile accounting for invoicing. A license key upgrades it into Wanguard, so the two share one codebase and one Console.

How the components fit together

All of these are Linux packages reporting to a single Console, and a license key decides which capabilities are switched on.

Deployment model and hardware

The software runs on any 64-bit Intel or AMD server, so you build your own appliance from commodity hardware. Andrisoft publishes a sizing guide per component and lists tested network cards for 10–100 Gbps. One explicit caveat from the vendor: virtual machines are for trials only, not production.

The design goal is that no traffic leaves your network and there is no appliance in the path — you are not buying per-gigabit capacity, you are licensing software on hardware you already control.

Licensing and trial

• Sensor licenses are listed at $595 per year, with volume discounts.
• The Console is free.
• Separate license lines exist for Wanguard Sensors, Wansight Sensors, Wanguard Filters, and DPDK Engine, plus Console rebranding and support plans.
• A free 30-day trial license key is available, and support is included.

Who it is for

Network operators — ISPs, hosting providers, and enterprises running their own routing and scrubbing infrastructure — who want detection and mitigation under their own control. If you would rather not manage Linux servers, sizing, and router integration yourself, an appliance-based or cloud-scrubbed service will fit better. If data sovereignty, no per-gigabit billing, and full control of the mitigation path matter more, Andrisoft's stack is built precisely around those constraints.

To move forward: request a trial key, check the sizing guide against your server and NIC inventory, and confirm whether your routers support Flowspec or RTBH for the mitigation path.

You can evaluate Andrisoft's software with a free 30-day license key, then license it per Sensor on an annual basis. Wanguard Sensor licenses are listed at $595 per year with volume discounts, the Console is free, and support is included. Because the products are Linux packages that run on your own servers, "trying" and "licensing" both mean installing the software on hardware you control and applying a key — there is no appliance to order and no traffic sent to a third party.

Getting a trial key

The trial path is the same for both products:

1. Request a trial key from the Andrisoft site ("Get a free 30-day license key").
2. Install the Linux packages on your own 64-bit Intel or AMD server.
3. Apply the key to activate the licensed components.

A key is what switches capabilities on and off inside the same packages. Wansight and Wanguard share the same Sensors and Console; the license key decides which features are enabled. That means a Wansight deployment can become Wanguard by applying a Wanguard key, without reinstalling a different product.

If you are already a customer, licensing and account tasks go through the support portal rather than the trial flow.

What you are actually licensing

Licenses are sold per component, not as a single product SKU:

Two practical consequences follow from this structure. First, a pure monitoring deployment needs only Wansight Sensor licenses plus the free Console. Second, adding detection and mitigation later is a licensing change, not a migration — the same Sensors and Console are already in place.

Choosing between Wanguard and Wansight

Both products use the same Sensors and Console, so the decision is about capability, not architecture:

• Wansight gives you bandwidth graphs for large numbers of IPs, top talkers, flow and packet forensics, and 95th-percentile accounting for invoicing. It is the monitoring and billing tool.
• Wanguard adds DDoS detection and mitigation: Sensors watch NetFlow, sFlow, IPFIX or mirrored packets, anomaly checks run every second, and attacks are stopped either on your routers (Flowspec, RTBH) or on Linux filtering servers.

If you only need visibility and billing data, license Wansight. If you need to detect and stop attacks on your own network, license Wanguard. If you are unsure, start with Wansight and upgrade with a key when detection becomes a requirement.

Hardware and deployment prerequisites

The software runs on any 64-bit Intel or AMD server; Andrisoft publishes per-component sizing guidance, tested network cards for 10–100 Gbps, and a note that virtual machines are for trials only. Plan your license count around the number of Sensors you need at those traffic levels, since that is the unit that carries the annual fee.

Common sticking points

• Assuming the Console costs extra. It is free; the paid units are Sensors, Filters, the DPDK Engine, rebranding, and support plans.
• Expecting a per-gigabit bill. Pricing is per Sensor license, not per gigabit of traffic.
• Treating the trial as production. VMs are documented as trial-only; production sizing assumes dedicated servers and tested NICs.
• Forgetting the upgrade path. Wansight does not need to be replaced to become Wanguard — a key changes what the existing installation does.

For current prices, discount thresholds, and support plan terms, confirm details with Andrisoft directly, since the figures above reflect the published listing rather than a quote for your deployment.

Andrisoft's Wanguard detects DDoS attacks by having Sensors continuously analyze NetFlow, sFlow, IPFIX, or mirrored packets, running anomaly checks every second, then mitigates on your own network — either by instructing your routers via Flowspec or RTBH, or by scrubbing traffic on Linux filtering servers. It runs as Linux packages on commodity 64-bit Intel or AMD hardware, with no appliance in the traffic path and no traffic leaving your network. This suits network operators who want attack detection in seconds, control over their own mitigation, and no per-gigabit fees.

The two halves: Sensors and Console

Wanguard splits into components that report to a single Console:

• Sensors watch traffic. Flow Sensors analyze flow exports (NetFlow, sFlow, IPFIX); Packet Sensors analyze mirrored packets. Anomaly checks run every second, which is how detection reaches "seconds" rather than minutes.
• Console is the central management and reporting layer. It is free; a license key decides which capabilities are switched on across the same Linux packages.

The same Sensor and Console packages also power Wansight, the traffic-monitoring sibling. Wansight gives bandwidth graphs, top talkers, flow and packet forensics, and 95th-percentile billing — without detection and mitigation. It becomes Wanguard when you apply a key.

How detection turns into mitigation

Once a Sensor flags an anomaly, mitigation happens on infrastructure you already control, in one of two ways:

1. Router-side mitigation — Wanguard signals your routers to drop or redirect attack traffic using Flowspec or RTBH (Remotely Triggered Black Hole). No scrubbing hardware is needed; your existing routers enforce the response.
2. Filtering servers — a Wanguard Filter scrubs diverted attack traffic at line rate on Linux servers. This is the option when you want to clean traffic before it reaches the destination rather than blackhole it.

Because both paths run inside your network, attack traffic is not handed to a third-party scrubbing center, and there is no per-gigabit scrubbing fee.

What "on-premise" changes for you

Virtual machines are described as suitable for trials only, so production sizing should follow the per-component sizing guidance and tested network cards.

Deciding whether it fits

Choose the on-premise model if you want detection in seconds, mitigation you control, and no traffic leaving your network or per-gigabit fees. If you only need visibility — bandwidth graphs, top talkers, forensics, 95th-percentile accounting — Wansight covers that and can be upgraded to Wanguard with a key. Andrisoft has offered this since 2006, is EU-based, and reports 1,000+ network operators across 50+ countries; a free 30-day trial key is available to evaluate it on your own servers.

Wanguard and Wansight are two products from Andrisoft that share the same Linux packages, the same Sensors, and the same Console — the difference is what the license key turns on. Wanguard adds DDoS detection and mitigation on top of traffic monitoring; Wansight is the monitoring-only version. If you need to stop attacks, you want Wanguard. If you only need bandwidth graphs, top talkers, forensics, and 95th-percentile billing, Wansight covers it — and it can become Wanguard later with a key.

The core difference: mitigation

Both products run on your own servers as Linux packages, with no appliance in the path and no traffic leaving your network. What separates them is whether the software acts on what it sees.

Wansight is described as Wanguard's "traffic-monitoring sibling" — the same Sensors and Console without detection and mitigation. That means the monitoring capabilities are not a reduced version; they are the same features, minus the security layer.

What Wanguard adds

Wanguard is positioned as on-premise DDoS detection and mitigation software. Two capabilities sit on top of the shared monitoring base:

• Detection in seconds. Flow and Packet Sensors analyze NetFlow, sFlow, IPFIX, or mirrored packets, and anomaly checks run every second.
• On-premise mitigation. Filters scrub diverted attack traffic at line rate on Linux servers, or your routers handle it via Flowspec and RTBH.

So the detection and mitigation work happens on infrastructure you control, rather than being outsourced to a scrubbing provider.

What Wansight covers

Wansight is the same stack without detection and mitigation. Its focus is visibility and accounting:

• Bandwidth graphs for hundreds of thousands of IPs
• Top talkers
• Flow and packet forensics, including an optional Flow Collector with interactive flow graphs and packet captures in a Wireshark-like viewer
• 95th-percentile accounting for invoicing

If your goal is to understand and bill for traffic rather than defend against attacks, this is the relevant set of features.

How to choose

The decision comes down to one question: do you need to detect and stop attacks, or only to see and account for traffic?

• Choose Wanguard if you need DDoS detection and mitigation on your own network — for example, if you operate routers you can steer traffic to via Flowspec or RTBH, or Linux filtering servers that can scrub diverted traffic.
• Choose Wansight if you need bandwidth graphs, top talkers, forensics, and 95th-percentile billing, but not attack mitigation — for example, for capacity planning or customer invoicing.
• Start with Wansight and upgrade if you are unsure. Because Wansight becomes Wanguard with a key, you are not locked into the monitoring-only product if your needs change.

Licensing and trying it

Sensor licenses are listed at $595 a year, with volume discounts, and the Console is free. A free 30-day trial license key is available. Wansight and Wanguard share the same Sensors and Console, so the licensing model follows the same components rather than being split into two unrelated product lines.

Andrisoft has been building this software since 2006, is EU-based, and reports 1,000+ network operators in 50+ countries. The current Wanguard release is listed as 9.0, July 2026.