Security Notifications tells the administrator of your Jellyfin server as soon as something abnormal or security-sensitive happens: who did it, from where, why it looks suspicious and what to do about it.
What it watches
20 rules, each with its own switch, threshold and severity:
- Attacks on accounts: bursts of wrong passwords from one address, many accounts tried from the same address (password spraying), a successful sign-in after many failures, a locked account.
- Unusual sign-ins: a new country for the account or "impossible travel" (two places too far apart in too little time); an administrator signing in from a new device, a new network, from outside the local network or at an unusual hour; sign-ins from a Tor exit or a known bad network (Spamhaus DROP).
- Sensitive changes: a new administrator or sensitive rights granted, a password changed, an account deleted, an API key created or deleted, a plugin installed, updated or removed, critical settings changed (remote access, HTTPS, trusted proxies, ports, UPnP).
- Damage and abuse: mass deletion from a library, one account used from too many places at once, an active session of a disabled account.
- Signs of compromise: scans and probes (
/.env,wp-login, path traversal), spoofed proxy headers, "Forgot password" used, known backdoor files or DLLs that appear in the plugins folder without a catalog install, a server version with published vulnerabilities.
Notifications
- Channels: Telegram, e-mail (SMTP), webhook (Discord, Slack, ntfy, Gotify or plain JSON) and the Jellyfin activity log. Each channel has its own minimum severity and a test button.
- No spam: the same alert at most once per interval, bursts grouped into one message, quiet hours (only critical alerts go out at once, the rest come in a summary at the end), optional daily digest.
- Content: what happened, which account, from where (address, country, city, network, device), why it is suspicious and what to check. Names sent by an attacker (device, app, account) are passed on as plain text.
- History of all alerts on the plugin page, with filters and CSV export.
Location and privacy
Location works without any account, from the free DB-IP Lite database (CC BY 4.0, "IP Geolocation by DB-IP"), downloaded monthly. With your own free MaxMind account the plugin can use GeoLite2 City and ASN instead. The databases are stored on your server: IP addresses are never sent to an outside lookup service. The Tor exit list and Spamhaus DROP are downloaded as lists and checked locally.
Requirements
- Jellyfin Server 12.2 or newer.
- For Telegram, e-mail or webhook alerts: a Telegram bot, an SMTP server or a webhook address. The Jellyfin activity log works without any of them.
Frequently asked
Can Jellyfin warn me when someone tries to break into my server? Yes, with Security Notifications: repeated wrong passwords, password spraying, a sign-in after many failures, a new country or an admin signing in from a new device send you an alert on the channels you choose. See the guide.
Is this the same as Access Log? No. Access Log keeps the full history of sign-ins and devices for you to browse; Security Notifications watches for suspicious events and changes and alerts you right away. They work well together.
Licensing
The plugin is open source (GPL-3.0), like Jellyfin itself. What you buy is the subscription for builds, updates and support for one Jellyfin server: ready-to-install releases through your private plugin repository, every update while the subscription is active, and help when something does not work. The plugin checks the subscription key once a day; without a valid subscription it stops until you renew (nothing is deleted). Monthly, yearly or lifetime (lifetime includes one year of updates), or included in the Jellyfin bundle. 30-day free trial.
Source code. For every release, the complete corresponding source code is downloadable from your account (Account → Licences, Source code) next to the build, under the same rules as the build, and each archive contains the full GPL-3.0 text (LICENSE). If you need the source of a version you can no longer download, ask us and we send it. See section 10 of the EULA.