OnionGuard
github.com/ihatemyfcklife/onionguard- Category
- Cybersecurity
- Rank
- No. 2003Tools index
Previous survey · No. 1949 ·
- Pricing
- Open Source
- Type
- TOOL
- Use case
- Security & Identity
- GitHub
- 3 stars
- Latest release
- v1.2.1
- Date
About
OnionGuard is a self-hosted, open-source admission-control engine built in Go for the specific threat model of anonymous services such as Tor onion sites, where visitor IP addresses are unavailable and JavaScript-based challenges cannot be used. It aims to separate legitimate traffic from automated abuse without relying on client IP reputation or browser scripts, the mechanisms most standard anti-abuse and DDoS tools depend on.
At a glance
OnionGuard provides HTTP admission controls for services where client IP is a poor identity signal, including Tor onion services. It is worth evaluating if you need rate limits and admission challenges without depending on IP reputation.
Good fit
Go service operators who can test how anonymous clients are admitted during load or abuse.
Consider something else when
Keep an existing ingress policy if clients are authenticated and its controls already fit the threat model.
Start here
Use a local test service and send a burst of synthetic requests. Check who is admitted, what a queued user sees and how the service responds when a dependency fails.
Cost and requirements
Apache 2.0. The Go module requires Go 1.22 and lists a Redis client. Storage and operations depend on deployment.
Limits to know
Admission controls are only one part of a service’s defenses. Test behavior with your client settings and outage policies before trusting the configured limits.
Sources checked 2026-11-05. Source-based assessment.
Why it made the leaderboard
Purpose-built admission control for Tor hidden services, giving operators a self-hosted, zero-JS defense against DDoS without relying on client fingerprinting or IP reputation, which don't work for anonymous traffic.
Tags
Tech Stack
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.