Defguard by defguard
Zero-Trust access management with true WireGuard® 2FA/MFA
About Defguard
From the project's README at github.com/defguard/defguard. Lightly cleaned for readability; for the full source see the upstream repo.
Defguard is an enterprise-grade open-source VPN solution built with the highest security standards in mind. It provides the world’s only multi-factor authentication (MFA) for WireGuard VPN connections, using either its built-in SSO (with TOTP, biometrics, etc.) or external SSO providers such as Google, Microsoft, Active Directory/LDAP, Okta, JumpCloud or any other OpenID Connect Provider.
Website | Getting Started | Features | Roadmap | Support Open, transparent, verifiable and inspectable Our security approach: https://defguard.net/security/ Our public penetration tests reports: https://defguard.net/pentesting/ Daily SBOM CVE scan: https://defguard.net/sbom/ Our detailed roadmap: https://github.com/orgs/DefGuard/projects/5 Our Architecture Decision Records: https://app.gitbook.com/o/Z3mGSAbEj9iLdZ7cNFlL/s/kHPDOBrb5X1TB8O3GsjW/~/changes/86/in-depth/architecture-decision-records Defguard provides Comprehensive Access Control (a complete security platform): WireGuard® VPN with 2FA/MFA - not 2FA to "access application" like most solutions
Health score breakdown
6-dimension composite. See methodology for formula and weights.
Adoption signals
Real-world usage data, pulled from each registry. The bigger the numbers, the more battle-tested the project.
| Signal | Value | Source |
|---|---|---|
| GitHub stars | 2.7k | github.com/defguard/defguard |
| GitHub forks | 96 | github.com/defguard/defguard |
Release & maintenance
Is this project actively maintained, or about to die? Check the recency of last commit and last release.
| Project age | 3.6 years | since Oct 2022 |
| Last commit | 3 days ago | May 4, 2026 |
| Releases shipped | 80 | last: 7 days ago |
| Security policy | SECURITY.md | declared by maintainers |
| Funding links | 1 | declared by maintainers |
Self-hosting cost across providers
Detected requirements: 4GB RAM, 40GB disk minimum. Cheapest plan per provider that meets the requirement.
| Provider | Plan | Specs | Monthly | |
|---|---|---|---|---|
| hetzner | CAX11 | 2c · 4GB · 40GB | $4.13 USD | Deploy → |
| vultr | VC2 | 1c · 1GB · 25GB | $5 USD | Deploy → |
| linode | Nanode 1GB | 1c · 1GB · 25GB | $5.12 USD | Deploy → |
| digitalocean | Basic Regular 1GB | 1c · 1GB · 25GB | $6 USD | Deploy → |
What people say on Hacker News
Ready to self-host Defguard?
Spin up a hetzner CAX11 (4GB RAM, 40GB disk) for $4.13/mo and follow the project's official install docs.
Data last refreshed May 7, 2026.
Similar open-source projects
Projects in our directory that replace the same SaaS or share topics with Defguard.