Laravel Defender is a security package for Laravel applications. It installs as a global middleware that inspects every request and blocks the ones carrying attack patterns. Everything runs on your own server.

Features

Attack detection: checks the URL, query string and headers for path traversal, SQL injection, XSS, code execution or Log4Shell, scanner user-agents (sqlmap, nikto, wpscan) and routes that bots probe (/wp-admin, /.env, /.git).
Login protection: counts failed logins per IP through Laravel's auth events. After 5 failures in 15 minutes, further attempts are refused before the password is checked. It works with Breeze, Fortify, Jetstream or any controller that uses Auth::attempt().
Honeypot antispam: a hidden field and a minimum fill time stop bots on your forms.
Auto-block: an IP that triggers 5 detections in an hour is blocked for 24 hours across the whole site. The limits are configurable, and you can also block and unblock IPs by hand from the console.
Monitor mode: detects, logs and alerts without blocking anything. Use it on a live site to check for false positives before you turn blocking on.
Whitelist: IPs (CIDR ranges too) and paths that are never inspected, such as your office IP, health checks or webhooks from services you trust.
Country-based access control: allows or denies traffic based on IP geolocation. It stays off until you list some countries.
IP reputation: looks up the AbuseIPDB score of IPs already flagged as suspicious and can block them.
Alerts: via log, database, email, Slack or webhook. Email, Slack and webhook send at most one alert per IP every 10 minutes, so a scan of 500 requests is one email.
Security audit: defender:audit finds a publicly accessible .env, APP_DEBUG turned on, insecure session cookies or missing security headers, and explains how to fix each one.

False positives

Request bodies aren't scanned by default, because comments, rich-text editors and code snippets would trigger patterns all the time. Generic HTTP clients such as curl or wget aren't blocked either, since uptime monitors use them. If a pattern matches legitimate traffic, you can ignore it or whitelist the path.

Responses and logs

A blocked visitor sees a generic access denied page that doesn't say which rule matched. The reason goes to the logs, which you can query, export (CSV/JSON) or prune from the console with defender:ip-logs, defender:stats, defender:export-logs and defender:prune-logs.

Integration with your application

Laravel Defender fires the SuspiciousRequestDetected and IpBlocked events, which you can listen to and add your own logic. If you have Laravel Pulse installed, the package adds a card showing detected threats and the most active IPs.

Privacy

Detection, blocking and logging all happen on your server. Only the optional IP geolocation and reputation lookups use external services. Alerts contain the IP, path, user-agent and reason, never cookies, headers or form fields.

Compatibility

Laravel 11 and 12 (PHP 8.2 or higher) and Laravel 13 (PHP 8.3 or higher), with Catalan, Spanish and English translations.

Laravel Defender