Run real CTF events
without shared hosts.
CTFHive is the hosted platform that gives organizers CTFd-grade scoreboards and HTB-style ephemeral labs — with kernel-level per-team isolation no shared CTF host can match. Git deploy, 1-click CTFd import, durable WireGuard configs, and layered anti-cheat included.
What shared CTF hosting cannot ship
Every capability below runs in production today — not a roadmap. This is what your organizers and players get on day one.
Per-team WireGuard isolation
Each team gets a kernel-enforced network reachable only by its own WireGuard peers. A flag leaked by one team is cryptographically useless to another.
One config, every lab
Players download a durable WireGuard profile once per slot and reuse it across every challenge spawn — no re-import between labs.
Ephemeral spawn-on-demand labs
Players spawn challenge containers on demand; they're reaped when idle or on event end. No shared challenge hosts, ever.
Layered anti-cheat
Per-team flag derivation, VPN telemetry correlation, and solve-time z-scores flag sharing — human-in-the-loop, never auto-ban.
Tamper-evident audit chain
Every privileged action is HMAC-chained. Tampering with one admin log row invalidates the rest — verifiable end-to-end.
Git & ctfcli deployment
Author challenges as YAML, push, and deploy with health checks. Bring an existing CTFd event over with 1-click import.
From checkout to a live event in minutes
We stand up your tenant
Dedicated infrastructure with custom domain and TLS, provisioned automatically right after checkout.
Bring your challenges
Push via Git / ctfcli or 1-click import an existing CTFd event. Validated YAML, health-checked on deploy.
Teams connect once, spawn many labs
Players register, form teams, import one WireGuard profile, and spawn isolated labs — scoreboard live from solve one.
Same price band. Real isolation.
Hosted CTFd gives you a scoreboard. HTB gives individuals labs. CTFHive gives organizers both — with per-team network fences.
| Capability | CTFHive | CTFd Hosted | HTB / TryHackMe |
|---|---|---|---|
| Per-team kernel network isolation | Every tier — iptables-enforced WireGuard | Shared challenge hosts | Per-user labs only (no team CTF) |
| Ephemeral spawn-on-demand labs | Built in — one click per challenge | Plugin / DIY scripting | Built in (subscription) |
| Team mode on mid-tier plan | Standard ($65/mo) | Not on Basic ($60) | N/A — individual seats |
| Durable WireGuard config | Download once per player — reuse every lab | Not offered | Per-machine profile |
| Layered anti-cheat + audit chain | Per-team flags, VPN telemetry, HMAC audit log | None | Limited / opaque |
| 1-click CTFd migration | Standard & up | N/A | N/A |
| Starting price (organizer) | $25/mo Solo | $60/mo Hosted Basic | $25–49/mo individual VIP |
| Concurrent VPN participants (top self-serve) | 512 (Pro) · 4 slots/team | Not published | 1 user per seat |
Plans for every event size
Every paid tier includes per-team kernel isolation. Standard ($65/mo) adds full team mode — CTFd Basic ($60) plus $5 for isolation CTFd cannot offer.
Solo training and single-player events with per-user ephemeral labs.
Start SoloClub, workshop & university CTFs with full team play and real per-team isolation.
Choose StandardLarger events and team competitions that need more concurrent challenge capacity.
Choose ProCompany-wide and multi-event training with SSO and custom labs.
Contact usRun your next CTF the right way.
Real isolation, durable WireGuard access, and layered anti-cheat — from $25/mo. Up to 512 concurrent VPN participants on Pro.