README

Comprehensive security suite for Laravel — the Wordfence equivalent.

WAF + scanner + ACL + audit log + live traffic + notifications, all configurable, all auditable, all Laravel-native.

Brand site: laravel-shield.ozankurt.com — docs, pricing, license activation.

Why Laravel Shield

Need	What Shield gives you
Block malicious requests	15+ WAF middlewares (XSS, SQLi, LFI, RFI, PHP wrappers, sessions, agents, geo, bots, keyword path filters) + DB-backed rule engine
Manage allow/deny lists	Unified `ls_acl` table — IP / CIDR / ASN / country / regex / hostname, first-match-wins evaluation, Redis-cached
Detect malware	Scanner with native engine + ClamAV + composer audit; quarantine + restore; signature feed sync
Audit-log everything	HMAC-chained `ls_audit_log`, file/config/composer drift detection, `HasAuditLog` trait for model events
See live traffic	Sampled `ls_live_traffic` table with optional real-time broadcasting (Reverb / Pusher / Ably)
Get alerts	Mail / Slack / Discord / Telegram / Webhook channels, severity-routed
Stay locked out?	Three-layer bypass (env key + config IPs + Artisan recovery commands)
Beyond Wordfence	Security headers + CSP nonce, honeypot routes, generalized redaction, suspicious activity scoring, HTTPS enforcement, cookie security audit, trusted-proxy auto-discovery, pre-configured rate limiters

Install

composer require ozankurt/laravel-shield
php artisan shield:install

shield:install publishes config + migrations + lang + assets, runs migrations, seeds lookup tables + ~47 built-in WAF rules + ~33 built-in malware signatures, generates LS_AUDIT_HMAC_SECRET + LS_BYPASS_KEY if missing, and optionally whitelists your current IP so you don't lock yourself out.

Then expose the dashboard by allowing the gate it defines:

// AppServiceProvider::boot()
Gate::define('viewShieldDashboard', fn ($user) => $user && $user->is_admin);

Visit /shield.

Quickstart middlewares

In your route file or middleware group, attach what you need:

Route::middleware('firewall.all')->group(function () {
    Route::post('/login', LoginController::class);
});

Route::post('/api/upload', UploadController::class)
    ->middleware(['firewall.av_uploads', 'throttle:shield_login']);

Route::middleware(['firewall.acl', 'firewall.headers'])->group(function () {
    // Public site with security headers + ACL evaluation
});

Configuration

After install, see config/shield.php. Every limit, threshold, regex, path, and behaviour is exposed. Highlights:

// Storage strategy (sync default; queue/redis_batch for high traffic)
'storage' => ['driver' => env('LS_STORAGE_DRIVER', 'sync'), 'sample_rate' => ['live_traffic' => 0.1]],

// Audit log with HMAC chain tamper evidence
'audit' => ['drift' => ['enabled' => true, 'paths' => ['config/' => '*.php', '.env' => null]]],

// Scanner with ClamAV (composer suggest xenolope/quahog)
'scanner' => ['clamav' => ['enabled' => env('LS_CLAMAV_ENABLED', false)]],

// Three-layer bypass for admin lockout recovery
'bypass' => ['ips' => array_filter(explode(',', env('LS_BYPASS_IPS', '')))],

// Beyond-WF extras (all opt-in)
'headers' => ['enabled' => true, 'csp' => ['enabled' => false, 'use_nonce' => true]],
'honeypot' => ['enabled' => false, 'paths' => ['wp-admin', '.env', 'phpmyadmin', '.git/config']],
'scoring' => ['enabled' => false, 'threshold' => 100, 'window' => 3600],

Documentation

Topic	Doc
Installation + configuration	docs/installation.md
ACL evaluation + matchers	docs/acl.md
Audit log + HMAC chain	docs/audit-log.md
Scanner + ClamAV + signatures	docs/scanner.md
File-change watcher	docs/security-watch.md
Notifications + multi-cadence reports	docs/notifications.md
Bypass mechanism	docs/bypass.md
Premium tier + license	docs/premium.md

Premium tier

Premium features live in the same package, gated by LS_PREMIUM_LICENSE_KEY at runtime. No separate composer repo, no Satis, no auth tokens. Buy at laravel-shield.ozankurt.com, paste the key into .env, premium features activate on next request.

Premium unlocks:

Real-time threat feed sync (free tier syncs daily; premium polls every few minutes)
Real-time IP blocklist subscription
Hosted audit-log sink (forward audit events to the Shield Central app for cross-site aggregation)
Future SIEM dashboard integration

The license check is honest soft-enforcement (see docs/premium.md — the real moat is the API services Ozan hosts, which patching the local check can't unlock).

Companion packages

ozankurt/laravel-shield-filament — Filament panel adapter. v1.x for Filament 3 + 4, v2.x for Filament 5+. (Ships post-1.0.)
ozankurt/laravel-shield-signatures — Public GitHub repo of malware signatures. shield:signatures-sync pulls from here.

License

MIT — see LICENSE.md.

ozankurt / laravel-security

Maintainers

Package info

Statistics

Security