PHPackages ali1/brute-force-shield - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Security](/categories/security) 4. / 5. ali1/brute-force-shield ActiveLibrary[Security](/categories/security) ali1/brute-force-shield ======================= A tool to enable powerful, easy to use, Brute Force Protection. 1.0.3(6y ago)110.0k[2 issues](https://github.com/Ali1/BruteForceShield/issues)1MITPHPPHP >=7.2CI failing Since Feb 21Pushed 6y ago1 watchersCompare [ Source](https://github.com/Ali1/BruteForceShield)[ Packagist](https://packagist.org/packages/ali1/brute-force-shield)[ Docs](https://github.com/Ali1/BruteForceShield)[ RSS](/packages/ali1-brute-force-shield/feed)WikiDiscussions master Synced today READMEChangelog (3)Dependencies (3)Versions (4)Used By (1) Brute Force Shield ================== [](#brute-force-shield) ### Features [](#features) - Use for IP address-based protection but can be used with other unique identifiers - Does not count re-attempts with same challenge details (e.g. if a user tries the same username/password combination a few times) - Designed to use with any data store (file, mysql, cache library) and any framework - Can block multiple attempts at the same username earlier than the normal limit (to give users a chance to enter the correct username if they have been trying with the wrong one) ### Requirements [](#requirements) - Composer - PHP 7.2 or higher - Any data store to persist the User History data between requests ### Installation [](#installation) ``` composer require ali1/brute-force-shield ``` ### Configuration [](#configuration) When applying protection, a Ali1\\BruteForceShield\\Configuration object can be provided. ``` $configuration = new Configuration(); $configuration->setTimeWindow(600) ->setTotalAttemptsLimit(10); ``` Configuration methodDetails`setTimeWindow(int $timeWindow)`Time in seconds until Brute Force Protection resets (default: 300)`setTotalAttemptsLimit(int $totalAttempts)`Number of attempts before blocking further challenges (default: 8)`addUnencryptedKey(string $keyName)`By default, all entered user data is irreversibly hashed when prepared for storage. Use `addUnencryptedKey` for each key for which you want the data to be stored plaintext to aid debugging or security logging (i.e. usernames)`setStricterLimitOnKey(string $keyName, int $limitAttempts)`This optional method is useful in id/password type scenarios. You can configure the shield to further limit the number of attempts if using the same id/username repeatedly (i.e. use `setStricterLimitOnKey('username', 7)` and `setTotalAttemptsLimit(10)` to allow 7 attempts for a user, and then another 3 if user tries a different username)### Usage [](#usage) As you will need your own architecture to store data and log blocked events, it is recommended to create a method, function, component or middleware to use this library. Check out [this CakePHP component](https://github.com/Ali1/cakephp-bruteforce/blob/master/src/Controller/Component/BruteforceComponent.php) as an example of a helper method you could use. However if you want to use it directly, here is an example: ``` public function login() { // prior to actually verifying data $bruteConfig = new Configuration(); $bruteConfig->setTotalAttemptsLimit(10) ->setStricterLimitOnKey('username', 7) ->addUnencryptedKey('username'); $cacheKey = 'BruteforceData.login.' . str_replace(':', '.', $_SERVER['REMOTE_ADDR']); $userDataRaw = Cache::read($cacheKey); // replace with your way of retrieving stored user data $shield = new BruteForceShield(); $userData = $userDataRaw ? json_decode($userDataRaw, true) : null; $userData = $shield->validate($userData, $_POST, $bruteConfig); Cache::write($cacheKey, json_encode($userData)); // replace with your way of storing user data if (!$shield->isValidated()) { Log::alert( "Bruteforce blocked\nIP: {$this->getController()->getRequest()->getEnv('REMOTE_ADDR')}\n", json_encode($userData) ); // replace with your own method of logging throw new TooManyAttemptsException(); // replace with your way of error handling and stopping execution } // now you can process the login attempt in the normal way } ``` ### Health Score 25 — LowBetter than 35% of packages Maintenance0 Infrequent updates — may be unmaintained Popularity23 Limited adoption so far Community11 Small or concentrated contributor base Maturity54 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~1 days Total 3 Last Release 2323d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/637933d952b260bfeeaf8ec8fda92a5acf7eda16df6044fe840f782058a4c7ae?d=identicon)[Ali1](/maintainers/Ali1) --- Top Contributors [![Ali1](https://avatars.githubusercontent.com/u/218558?v=4)](https://github.com/Ali1 "Ali1 (15 commits)") --- Tags securitybruteforce ### Code Quality TestsPHPUnit Static AnalysisPHPStan Type Coverage Yes ### Embed Badge ![Health badge](/badges/ali1-brute-force-shield/health.svg) ``` [![Health](https://phpackages.com/badges/ali1-brute-force-shield/health.svg)](https://phpackages.com/packages/ali1-brute-force-shield) ``` ### Alternatives [phpseclib/phpseclib PHP Secure Communications Library - Pure-PHP implementations of RSA, AES, SSH2, SFTP, X.509 etc. 5.6k465.6M1.5k](/packages/phpseclib-phpseclib)[defuse/php-encryption Secure PHP Encryption Library 3.9k175.2M254](/packages/defuse-php-encryption)[mews/purifier Laravel 5/6/7/8/9/10 HtmlPurifier Package 2.0k18.7M143](/packages/mews-purifier)[robrichards/xmlseclibs A PHP library for XML Security 41484.3M149](/packages/robrichards-xmlseclibs)[voku/anti-xss anti xss-library 72817.9M94](/packages/voku-anti-xss)[spatie/laravel-csp Add CSP headers to the responses of a Laravel app 86611.1M25](/packages/spatie-laravel-csp) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)