Free trial

Five steps from nothing to a scanning server

1. Create a customer account. The shop at shop.shelltrap.com is also the client area: your trial key, your invoices later, and the list of servers a key is active on all live there.

2. Confirm your email address. You get a confirmation mail; the trial starts once you have clicked it. Disposable mailbox domains are turned away at this step. Use an address someone reads — findings are mailed from sentinel@shelltrap.com, and the notice that the trial is ending goes to the same place.

3. Order the trial. Pick Shelltrap Trial in the cart. That gives you 14 free days in report-only mode. If you store a payment method in the client area — credit card or PayPal — the same trial is extended to 30 days from the day it started, automatically and without a second order. Nothing is charged for the trial itself in either case.

   In the 30-day variant you may also agree, at that moment, that the trial should continue as the monthly subscription once the 30 days are up. That order is marked expressly as carrying a payment obligation from day 31, and you can cancel it at any time to the end of the term. Leave the box alone and the trial just ends.

4. Install and activate. Packages come from the licence service against your key, exactly as they do for a paying customer — a trial key works in the download form like any other. On a CyberPanel host install the scanner and the panel plugin; on a cPanel host install the scanner alone.

   sudo shelltrap license activate STL-XXXXX-XXXXX-XXXXX-XXXXX-XXXXX
   shelltrapd --config /etc/shelltrap/shelltrap.toml --check
   shelltrap health
   shelltrap status
   

   status prints the number of indexed sites. If that number does not match the domains you expect from your panel, stop and tell us before you go any further: a site index that is quietly incomplete is worse than one that fails loudly.

5. After 14 or 30 days. The scanning stops; your record of it does not. What that means precisely is below .

What runs, and what deliberately does not

During the trial the product is not cut down. Real-time watching through fanotify, the reconciliation crawl behind it, ClamAV, YARA 4.5, hash sets with the known-good allowlist, the scored heuristics, signed feed generations with per-rule provenance, findings with every signal that produced them, mail notifications, health and metrics — all of it runs, on your machine, with your files never leaving it.

What does not run is automatic quarantine, and that is on purpose in both tiers:

• In the 14-day trial nothing is moved at all. The upload gate reports a malicious verdict instead of answering HTTP 403.
• In the 30-day trial you get the acting half of the product too: quarantine and restore by hand, the upload gate with blocking switched on, and per-domain policies with their visible inheritance. Only the policy action quarantine stays on report until the trial becomes a licence.

Nobody sensible lets a scanner they met last week delete files on a box with paying customers on it. Report-only is not a crippled trial mode; it is the mode we run first on our own production hosts, and the one the installation guide tells you to start in even after you have bought the licence.

The conditions, in plain words

• A customer account with a confirmed email address, at a domain that is not a disposable mailbox service.
• One trial per server and one per customer. The trial is bound to the server fingerprint — a hash derived from /etc/machine-id, the same identifier a paid licence uses — and it is renewed online once a day. Moving the clock, reinstalling the package or leaving the licence service unreachable does not add days to it; the trial simply runs its course from the day it started.
• No automatic quarantine, in either tier.
• A payment method on file extends, it does not restart. Store one on day nine and the trial ends on day 30 counted from day one, not from day nine.
• Nothing is charged for the trial, and nothing continues afterwards unless you agreed to it when you ordered.

If your situation does not fit that — a fleet you can only touch in one maintenance window, a migration that slipped, a second server you need to test on for a real reason — write to us . We would rather hear it than have you work around it.

What the daily check sends

The trial key is renewed once a day by the same mechanism a paid licence uses, and it sends the same fields:

• the key prefix — never the key itself,
• the server fingerprint, a hash over /etc/machine-id,
• the hostname,
• the version and the operating system.

That is the whole list. No file, no file name, no path, no hash of anything you scanned, no count of findings, no telemetry. The renewal runs in shelltrap-license.timer, a systemd unit separate from the daemon, because it is the only component that is allowed to talk to the network at all — shelltrapd itself is restricted to AF_UNIX.

Findings, quarantine, paths and the audit chain stay in /var/lib/shelltrap on your machine for the whole trial and after it. The privacy statement has the legal version of this paragraph, and licensing has the technical one.

When the trial ends

The daemon stops scanning and stops updating its feeds. It does not crash, it does not restart-loop, and it does not quietly report clean:

• the watcher keeps counting events but they are not scanned,
• the scheduler plans nothing,
• the upload gate answers allow with the reason unlicensed,
• health reports unlicensed with a precise cause,
• the feed service answers 401.

Everything you already have stays where it is: findings with their signals, the hash-chained audit trail and the full quarantine, visible in the panel and through the CLI, restorable as before. Quarantine is evidence, and nothing on our side deletes it.

To carry on being protected, order the licence: 14.90 EUR per server and month or 149.00 EUR per year, both including German VAT, covering every domain and account on that machine. The pricing page has the net figures for business customers and the volume threshold.

Moving to a paid licence

There is no migration and no second installation. The trial key stays valid through the changeover, and a paid key activated on the same server takes over seamlessly — same packages, same configuration, same policies, same quarantine:

sudo shelltrap license activate STL-XXXXX-XXXXX-XXXXX-XXXXX-XXXXX
shelltrap license status

Switching by hand in the client area unlocks automatic quarantine immediately; until you do, the policy action stays on report, which is exactly where a careful operator would leave it for the first week anyway.

If you agreed to the automatic continuation when you ordered the 30-day trial, this happens on its own on day 31 and you get an invoice for the first month. If you did not, nothing happens and nothing is charged.

Next

• Pricing — what it costs after the trial, gross and net
• Download — packages against a licence or trial key
• Installation and first run — the profile decision and starting in report-only
• Shelltrap on cPanel — what the beta covers on a cPanel/WHM host
• Terms of business and the licence terms

Questions people ask