Redis protected mode
Protected mode is a safety feature Redis has enabled by default since version 3.2.0, intended to limit the damage of RESP's lack of built-in authentication. When a Redis instance starts with no password set and a bind address that isn't restricted to loopback, protected mode automatically refuses connections from any client that isn't connecting from localhost, per Redis's own documentation. It is not a substitute for setting a password with Redis's AUTH mechanism or Access Control Lists -- an administrator can disable protected mode explicitly, bind Redis to a public interface deliberately, or change the bind address without realizing the two settings interact, and any of those reintroduce the original no-password exposure. Because protected mode is a configuration default rather than a protocol-level control, whether it's still active on a given instance has to be checked directly, not assumed.
By AdminKit team, Netbase JSC · Updated