PHPackages                             ali1/cakephp-bruteforce - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. ali1/cakephp-bruteforce

ActiveCakephp-plugin[Security](/categories/security)

ali1/cakephp-bruteforce
=======================

CakePHP-native brute-force protection plugin

6.1.1(2w ago)35.4k2MITPHPPHP ^8.2CI failing

Since May 17Pushed 3d ago1 watchersCompare

[ Source](https://github.com/Ali1/cakephp-bruteforce)[ Packagist](https://packagist.org/packages/ali1/cakephp-bruteforce)[ Docs](https://github.com/ali1/cakephp-bruteforce)[ RSS](/packages/ali1-cakephp-bruteforce/feed)WikiDiscussions master Synced 1w ago

READMEChangelog (10)Dependencies (14)Versions (25)Used By (0)

CakePHP Brute Force Plugin
==========================

[](#cakephp-brute-force-plugin)

[![Framework](https://camo.githubusercontent.com/3c6b4002e9a4a17b0312283bd3633dc64c66ec40628b8c29841731d29ba5f312/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4672616d65776f726b2d43616b65504850253230352e782d6f72616e67652e737667)](https://cakephp.org)[![PHP](https://camo.githubusercontent.com/0f16581d1180dbfd4c0e13166ec1267d4ad2f2fab8281ea6d6b284cf5c65d921/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d382e322532422d626c75652e737667)](https://www.php.net/)[![license](https://camo.githubusercontent.com/7afc2480f8e1a6e357efb9abfcd8c9ca480e31fdf0a0ea755fbcfe8533b3eab8/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c6963656e73652f616c69312f63616b657068702d6272757465666f7263652e7376673f6d61784167653d32353932303030)](/blob/master/LICENSE)

A CakePHP 5 plugin providing cache-backed brute-force protection for controller actions. The limiter is implemented in this package; it is not a wrapper around BruteForceShield.

Features
--------

[](#features)

- Per-client-IP and cross-IP attempt budgets
- Optional stricter limit for repeated attempts against one field, such as a username
- Duplicate-challenge detection, so retrying exactly the same values does not consume another attempt
- Server-keyed HMAC-SHA256 storage for every submitted value
- Inter-process locking around each complete cache read/check/write transaction
- Fail-closed cache writes and lock acquisition, with critical logging
- Alert logging for blocked attempts without submitted values

Requirements
------------

[](#requirements)

- PHP 8.2+
- CakePHP 5.x
- A CakePHP cache configuration shared by all PHP workers serving the application
- A non-empty, secret `Security.salt`

Development
-----------

[](#development)

Install development dependencies and run the complete quality gate:

```
composer install
composer check
```

The gate runs CakePHP coding standards, PHPStan, and the PHPUnit suite.

The lock files live in PHP's system temporary directory and coordinate workers on one host. Each cache configuration uses a fixed pool of 256 striped locks, so rotating client addresses cannot create unbounded files. A multi-host deployment must put that directory on shared storage or add a distributed lock before sharing one limiter cache across hosts.

Installation
------------

[](#installation)

```
composer require ali1/cakephp-bruteforce
```

Load the plugin in `src/Application.php`:

```
$this->addPlugin('Bruteforce');
```

Load the component in a controller:

```
public function initialize(): void
{
    parent::initialize();
    $this->loadComponent('Bruteforce.Bruteforce');
}
```

Basic use
---------

[](#basic-use)

Call `validate()` before checking or acting on submitted credentials:

```
use Bruteforce\Configuration;

$configuration = (new Configuration())
    ->setTotalAttemptsLimit(60)
    ->setStricterLimitOnKey('username', 7);

$this->Bruteforce->validate(
    'login',
    [
        'username' => $this->request->getData('username'),
        'password' => $this->request->getData('password'),
    ],
    $configuration,
);
```

The component throws `Bruteforce\Exception\TooManyAttemptsException` when a limit is reached or protection cannot safely persist the attempt.

Applications upgrading from version 6.0 may temporarily keep importing `Ali1\BruteForceShield\Configuration`; this package provides that name as a deprecated compatibility class. New code should use `Bruteforce\Configuration`.

Limiter options
---------------

[](#limiter-options)

The fifth `validate()` argument accepts additional options. For applications migrating from a local limiter whose third argument was an options array, the component also accepts that array directly as its third argument.

OptionDefaultMeaning`timeWindow``300`Per-IP rolling window in seconds`totalLimit``8`Distinct attempts allowed per IP`stricterKey``null`Field receiving a lower per-value limit`stricterLimit``null`Distinct attempts allowed for `stricterKey``globalTotalLimit``100`Distinct attempts allowed across all IPs`globalStricterLimit`per-IP valueCross-IP limit for `stricterKey``globalTimeWindow`per-IP valueCross-IP rolling window in seconds`skipGlobal``false`Explicitly disable the cross-IP check for this request`challengeKeys`all fieldsSubmitted fields included in duplicate and limit checks`caseInsensitiveKeys`noneFields lowercased before comparison, commonly usernames`cache`component argumentCakePHP cache configuration nameThe cross-IP budget is enabled by default. It is the backstop when an attacker can rotate source addresses or when a proxy configuration mistakenly accepts spoofed `X-Forwarded-For` values. Set an application-specific value based on legitimate aggregate traffic; disable it only when another trusted edge enforces an equivalent global budget.

Proxy configuration
-------------------

[](#proxy-configuration)

The component accepts `ServerRequest::clientIp()` only when it is a valid single IP address and otherwise falls back to the direct `REMOTE_ADDR`. This validation does not make an untrusted forwarding header trustworthy. If CakePHP request proxy trust is enabled, configure an explicit allowlist of trusted reverse-proxy addresses; never enable unrestricted proxy trust. Keep the global budget enabled even with a correct allowlist.

Stored and logged data
----------------------

[](#stored-and-logged-data)

Every non-empty scalar challenge value is normalized in memory and stored only as `HMAC-SHA256(value, Security.salt)`. The random-looking cache value is deterministic so duplicate and stricter-key comparisons remain efficient, but an attacker who obtains only the shared cache cannot run an offline dictionary attack without the server secret.

Blocked-attempt logs contain the client IP, action name, limiting scope, submitted field names, and attempt count. They never contain submitted values. The legacy `addUnencryptedKey()` method is retained only so existing applications keep running; it no longer causes plaintext cache storage or logging and should be removed from application code.

URL-token protection
--------------------

[](#url-token-protection)

Secret URL tokens use the same protection and must not be marked for plaintext handling:

```
$configuration = (new Configuration())->setTotalAttemptsLimit(5);

$this->Bruteforce->validate(
    'publicAuthUrl',
    ['hashedid' => $hashedid],
    $configuration,
);
```

###  Health Score

59

—

FairBetter than 98% of packages

Maintenance98

Actively maintained with recent releases

Popularity28

Limited adoption so far

Community9

Small or concentrated contributor base

Maturity83

Battle-tested with a long release history

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~114 days

Recently: every ~583 days

Total

24

Last Release

15d ago

Major Versions

0.4.0 → 4.0.12019-12-23

4.3 → 5.02020-02-21

5.0.3 → 6.0.02026-06-24

PHP version history (4 changes)0.1PHP >=5.4.16

0.3.2PHP >=7.0

4.0.3PHP >=7.2

6.0.0PHP ^8.2

### Community

Maintainers

![](https://www.gravatar.com/avatar/637933d952b260bfeeaf8ec8fda92a5acf7eda16df6044fe840f782058a4c7ae?d=identicon)[Ali1](/maintainers/Ali1)

---

Top Contributors

[![Ali1](https://avatars.githubusercontent.com/u/218558?v=4)](https://github.com/Ali1 "Ali1 (74 commits)")

---

Tags

pluginsecuritycakephpbruteforce

###  Code Quality

TestsPHPUnit

Static AnalysisPHPStan

Type Coverage Yes

### Embed Badge

![Health badge](/badges/ali1-cakephp-bruteforce/health.svg)

```
[![Health](https://phpackages.com/badges/ali1-cakephp-bruteforce/health.svg)](https://phpackages.com/packages/ali1-cakephp-bruteforce)
```

###  Alternatives

[dereuromark/cakephp-tools

A CakePHP plugin containing lots of useful and reusable tools

3321.0M51](/packages/dereuromark-cakephp-tools)[dereuromark/cakephp-tinyauth

A CakePHP plugin to handle user authentication and authorization the easy way.

131242.7k13](/packages/dereuromark-cakephp-tinyauth)[cakephp/bake

Bake plugin for CakePHP

11212.2M223](/packages/cakephp-bake)[dereuromark/cakephp-ide-helper

CakePHP IdeHelper Plugin to improve auto-completion

1892.4M48](/packages/dereuromark-cakephp-ide-helper)[dereuromark/cakephp-setup

A CakePHP plugin containing lots of useful management tools

35213.9k2](/packages/dereuromark-cakephp-setup)[dereuromark/cakephp-databaselog

A CakePHP plugin for storing and viewing application logs in the database

44174.4k2](/packages/dereuromark-cakephp-databaselog)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)