Redis protected-mode Explained: Understanding Redis Security Protection

Introduction

The protected-mode directive is a built-in security feature that helps prevent unauthorized access to Redis servers.

When enabled, Redis restricts connections from remote hosts unless the server has been explicitly configured for network access and authentication.

This feature was introduced to reduce the number of Redis servers accidentally exposed to the public Internet without proper security.

This guide explains how protected-mode works, when Redis enables it, and how to configure it safely.

Default Value

Most Redis installations use:

protected-mode yes

This means Redis enables additional security checks during startup.

Syntax

Enable protected mode:

protected-mode yes

Disable protected mode:

protected-mode no

Why Does Redis Use Protected Mode?

Redis was originally designed for trusted internal networks.

If Redis listens on a public network without authentication, anyone can potentially:

Read application data.

Modify cached values.

Delete databases.

Execute administrative commands.

Shut down the Redis server.

Protected mode helps prevent these situations by refusing unsafe remote connections.

How Protected Mode Works

Suppose Redis is configured as follows:

bind 0.0.0.0

protected-mode yes

requirepass

If no password is configured and Redis is reachable from remote hosts, Redis may reject external connections to protect the server.

Typical error:

DENIED Redis is running in protected mode because protected mode is enabled, no bind address was specified, no authentication password is requested, and the request was not from the loopback interface.

This message indicates Redis has detected an insecure configuration.

Configure Protected Mode

Open the Redis configuration file.

sudo nano /etc/redis.conf

Locate:

protected-mode yes

Leave it enabled unless you fully understand the security implications.

Restart Redis.

sudo systemctl restart redis

When Should You Disable Protected Mode?

In most cases, you should not.

Disabling protected mode may be appropriate only when:

The server is on a trusted private network.

Authentication has been configured.

Firewall rules restrict access.

Network interfaces are properly configured using bind.

Example:

bind 192.168.1.100

requirepass MyStrongPassword123!

protected-mode no

This allows trusted remote clients to connect while still protecting the server through authentication and network restrictions.

Verify the Configuration

Run:

redis-cli CONFIG GET protected-mode

Example output:

1) "protected-mode"

2) "yes"

Protected Mode vs bind

Many administrators confuse these two settings.

| Directive      | Purpose                                             |
| -------------- | --------------------------------------------------- |
| protected-mode | Prevents unsafe remote access                       |
| bind           | Specifies which network interfaces Redis listens on |

The bind directive controls where Redis listens.

The protected-mode directive determines whether Redis should reject potentially unsafe remote connections.

Protected Mode vs requirepass

These settings also serve different purposes.

| Directive      | Purpose                            |
| -------------- | ---------------------------------- |
| protected-mode | Blocks unsafe access automatically |
| requirepass    | Requires clients to authenticate   |

For production environments, both features should be used together whenever possible.

Common Mistakes

Disabling Protected Mode Immediately

Some online tutorials recommend:

protected-mode no

without explaining the associated risks.

This may expose Redis to the public Internet.

Using bind 0.0.0.0 Without Authentication

Example:

bind 0.0.0.0

protected-mode no

This configuration is highly insecure unless additional protections such as firewalls and authentication are in place.

Assuming Protected Mode Replaces Authentication

Protected mode is a safety mechanism, not an authentication system.

Production servers should still use:

requirepass or Redis ACLs

Firewall rules

Private network access

Strong passwords

Best Practices

Keep protected-mode enabled unless remote access is required.

Configure the bind directive appropriately.

Enable authentication using requirepass or ACLs.

Never expose Redis directly to the public Internet.

Restrict access with firewall rules or VPNs.

Regularly review Redis security settings.

Related Articles

Redis Explained

Redis bind Explained

Redis requirepass Explained

Redis port Explained

Redis ACL Explained

Conclusion

The protected-mode directive is an important security feature that helps prevent accidental exposure of Redis servers. By blocking unsafe remote connections, it provides an additional layer of protection for systems that have not yet been fully secured.

For most production environments, protected mode should remain enabled unless remote access is required and appropriate security measures—such as authentication, firewall rules, and network restrictions—have already been implemented.