niladam / livewire-ban
Automatically ban IP addresses that trigger Livewire exceptions no legitimate browser session can produce.
Requires
- php: ^8.3|^8.4
- illuminate/contracts: ^13.0
- laravel/prompts: ^0.3|^1.0
- livewire/livewire: ^4.0
Requires (Dev)
- larastan/larastan: ^3.12
- laravel/pint: ^1.0
- orchestra/testbench: ^11.0
- pestphp/pest: ^4.0|^5.0
Suggests
- filament/filament: Adds an admin panel resource for reviewing and lifting bans.
Provides
None
Conflicts
None
Replaces
None
This package is auto-updated.
Last update: 2026-09-13 04:48:31 UTC
README
Automatically ban IP addresses that trigger Livewire exceptions a real browser never produces.
A bot that scrapes a component snapshot off your site and starts tampering with it throws exceptions no legitimate session throws. This catches them, counts strikes, bans the address, emails you, and gives you a signed link to undo it from your phone.
Install
composer require niladam/livewire-ban
Publish the migration and see what is already in force:
php artisan livewire-ban:install
Create the table:
php artisan migrate
That is the whole setup. The middleware registers itself, and every setting has a working default:
| Behaviour | Out of the box |
|---|---|
| Threshold | 3 strikes in 10 minutes, then a 1 hour ban |
| Escalation | 1h → 6h → 24h → 7d for repeat offenders inside a day |
| Alerts | One queued email per ban, capped at 10/hour |
| Undo | A signed link in every alert, good for 7 days |
Point the alerts somewhere real and you are done:
LIVEWIRE_BAN_ALERT_EMAIL=security@yourapp.com LIVEWIRE_BAN_ALLOWLIST=203.0.113.5,10.0.0.0/8
Using Filament? One line gets you a read-only panel for reviewing and undoing bans:
$panel->plugin(\Niladam\LivewireBan\Filament\LivewireBanPlugin::make());
What it catches
Two exceptions, both of which require an attacker to have taken a real snapshot from your live site and altered it:
| Exception | What it means |
|---|---|
CorruptComponentPayloadException |
The snapshot's checksum does not match. Someone edited it in flight. |
CannotUpdateLockedPropertyException |
A #[Locked] property was targeted by an update. |
Both are configurable, and your own exceptions can join them.
Documentation
| Page | Covers |
|---|---|
| Configuration | Every setting: strikes, escalation, permanent bans, scope, exemptions, pruning |
| Extending | Hooks, events, your own model, banning by hand |
| Reference | The API, and what a ban row records |
| Design notes | Why these triggers, why this IP, why middleware |
Requirements
Laravel 13, Livewire 4, PHP 8.3 or 8.4.
Testing
composer test
License
MIT. See LICENSE.md.