Serve the site.Hide the rest.
A public web server has to answer on 80 and 443. Everything else it listens on is optional exposure.
The site needs 80 and 443.Nothing else does.
A web server is rarely listening on only its published ports. Management consoles, admin panels, deployment endpoints, staging virtual hosts and the SSH or RDP used to maintain the box are all reachable alongside the site itself.
Admin panels and deployment endpoints answer the same scan that finds the website.
Non-production sites, often left on defaults, discoverable alongside the live one.
The remote access used to maintain the box, reachable from anywhere.
The site stays open.The back door is gone.
The port is closed.Not hidden.
SSHepherd closes the listening ports that are not meant to be public, while the site keeps serving normally on 80 and 443.
Administrative access to the host — the shell, the management console, the deployment path — moves onto an outbound connection to the broker, reachable only by authorised identities.
Only authorised identities are admitted. Every session can be monitored, recorded and ended on demand.
Developed by Full Armor Corporation. Distributed, deployed and supported across Southeast Asia by Auris.
- Nothing listens inbound
- Access via broker only
- Every session monitored
Your team keeps working.Scanners get nothing.
Visitor traffic on 80 and 443 continues to be served as normal.
Management and deployment endpoints stop answering scans from the internet.
Non-production virtual hosts are no longer discoverable alongside the live site.
An application that cannot safely be upgraded is protected by being unreachable.
Watch it work.
Protect your IIS servers from hackers. A recorded demo from Full Armor, the developer of SSHepherd®.
Common questions.
Will this affect visitors to my website?
No. Ports 80 and 443 continue to serve traffic normally. SSHepherd closes the management and administrative ports that were never intended to be public.
Does it work with both Apache and Microsoft IIS?
Yes. SSHepherd operates at the port level rather than inside the web server, so the same model covers Apache, IIS and the tooling around them.
Can it protect an application we cannot patch?
Yes, and this is a common reason to deploy it. An unpatched or end-of-life admin interface that cannot be reached from the internet cannot be exploited from the internet.
See it onyour own servers.
Tell us roughly what you run: how many servers, and whether they are on-premise or in the cloud. We will set up a demo with an engineer and reply within one business day.