Someone is trying your door right now

Put a website online today and something will come looking for .env before the day is out. Not a person — a machine, working through a list: old backups, forgotten config files, a leftover admin page. It costs the sender nothing, so it never stops.

Almost always it finds nothing, and nothing happens. That is the good case, and it is also the boring one. The bad case is quieter: one forgotten file that answers instead of refusing — and nobody notices for months.

The doorman

Switch it on in Security and MAESTRO starts keeping a record of who asks your sites for what. Nothing about your sites changes and nothing gets slower — the web server simply writes down the knocks.

• It stays quiet when nothing is found. Hundreds of attempts a week is the normal weather of a public address. You get one calm line about it, not an alarm.
• It speaks the moment a door opens. If one of those requests is actually answered, that is a real event — and the one thing worth interrupting you for.
• It checks who is really outside. The most determined scanners arrive wearing a search engine's name, because everyone waves those through. MAESTRO asks the search engines themselves which addresses are really theirs, and can tell the difference.

Honest about what it is

This is not a shield in front of your site, and we won't pretend otherwise. It cannot stop a flood of traffic. What it does is far more useful for a small site: it tells you, in plain words, whether anything on your machine is quietly handing out things it shouldn't — the leak that actually ends up costing people.

And when your site sits behind a service like Cloudflare, it reads the real visitor's address, not the middleman's — so what you see is who was really there.

What you'll see

A single card: how many knocks this week, how many were looking for secrets, how many arrived under a borrowed name — and, in green, how many were answered. Green zero is the whole point. On the day it isn't zero, you'll know within minutes, and you'll be told exactly which file to move and which passwords to change.

Nobody enjoys thinking about this. That's rather the idea: MAESTRO thinks about it so you don't have to, and only interrupts when interrupting is the kind thing to do.

← all articles