PHPackages                             egcservices/rbruteforce2 - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. egcservices/rbruteforce2

ActiveCakephp-plugin[Security](/categories/security)

egcservices/rbruteforce2
========================

CakePHP 4+ Plugin for Protection Against BruteForce Attacks

3.2(4y ago)11892MITPHPPHP >=7.2

Since Sep 1Pushed 4y ago1 watchersCompare

[ Source](https://github.com/elsongabriel/rBruteForce)[ Packagist](https://packagist.org/packages/egcservices/rbruteforce2)[ Docs](https://github.com/elsongabriel/rBruteForce)[ RSS](/packages/egcservices-rbruteforce2/feed)WikiDiscussions master Synced 1mo ago

READMEChangelog (7)Dependencies (4)Versions (10)Used By (0)

rBruteForce
===========

[](#rbruteforce)

CakePHP 4+ Plugin for Protection Against BruteForce Attacks

CakePHP rBruteForce Plugin
==========================

[](#cakephp-rbruteforce-plugin)

With rBruteForce you could protect your CakePHP applications from Brute Force attacks.

Requirements
------------

[](#requirements)

- CakePHP 4.8 or greater.
- PHP 7.2 or greater.

Installation
------------

[](#installation)

### 1. Create the database tables.

[](#1-create-the-database-tables)

The schema could be found in `config/Schema/rBruteForce.sql`.

```
CREATE TABLE IF NOT EXISTS `rbruteforcelogs` (
  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
  `data` text,
  PRIMARY KEY (`id`)
) ENGINE=InnoDB  DEFAULT CHARSET=utf8;

CREATE TABLE IF NOT EXISTS `rbruteforces` (
  `ip` varchar(255) NOT NULL,
  `url` varchar(255) NOT NULL,
  `expire` timestamp NOT NULL DEFAULT '0000-00-00 00:00:00',
  PRIMARY KEY (`expire`),
  KEY `ip` (`ip`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
```

The migrations files could be found in `config/Migrations`.

```
//CreateRBruteForces Migration
public function change()
{
	$table = $this->table('rbruteforces', ['id' => false, 'primary_key' => ['expire']]);
	$table
		->addColumn('ip', 'string', ['length' => 255])
		->addColumn('url', 'string', ['length' => 255])
		->addColumn('expire', 'timestamp', ['default' => null])
		->addIndex('ip');
	$table->create();
}

//CreateRBruteForceLogs Migration
public function change()
{
	$table = $this->table('rbruteforcelogs');
	$table->addColumn('data', 'text', ['null' => true]);
	$table->create();
	$table->changeColumn('id', 'integer', ['signed' => false, 'identity' => true]);
	$table->update();
}

```

### Install via composer.

[](#install-via-composer)

Add the plugin to your project's `composer.json` - something like this:

```
{
  "require": {
    "egcservices/rbruteforce2": "3.0"
  }
}
```

### Load the plugin

[](#load-the-plugin)

```
Plugin::load('RBruteForce', ['bootstrap' => false, 'routes' => true]);
```

### .gitignore

[](#gitignore)

Because this plugin has the type cakephp-plugin set in it's own composer.json, composer knows to install it inside your /Plugin directory, rather than in the usual vendors file. It is recommended that you add /Plugin/RBruteForce to your .gitignore file.

Reporting Issues
----------------

[](#reporting-issues)

If you have a problem with rBruteForce please report [here](https://github.com/elsongabriel/rBruteForce/issues)

Documentation
=============

[](#documentation)

rBruteForce bans IP-s on unsuccessful login, or on any other method.

Usage
-----

[](#usage)

As this plugin is a component you should add it to your `Controller`'s `$components` array.

```
class UsersController extends AppController {

	public $components = ['RBruteForce.RBruteForce'];
```

Let's see an example for the `UsersController` `login` method with rBruteForce

```
public $_options;
public $_ipsAllowed;

public function initialize()
{
	parent::initialize(); // TODO: Change the autogenerated stub
	$this->_options = [
		'maxAttempts'     => 4,                        //max failed attempts before banning
		'expire'          => "10 minutes",             //expiration time
		'dataLog'         => true,                     //log the user submitted data
		'urlToRedirect'   => '/users/reportBruteForce' //url to redirect if failed.
	];
	$this->_ipsAllowed = ['127.0.0.1', '172.68.26.185', '191.179.112.160'];
}

public function login()
{
	if ($this->request->is('post')) {
		$myIp = $_SERVER['REMOTE_ADDR'];
		if (!$this->RBruteForce->isIpBanned($this->_options) || in_array($myIp, $this->_ipsAllowed)) {
			$user = $this->Auth->identify();
			if ($user) {
				$this->Auth->setUser($user);
				return $this->redirect($this->Auth->redirectUrl());
			}
			$this->RBruteForce->check($this->_options); //unsuccessful logins will be checked
			$this->Flash->error(__('Invalid username or password, try again'));
		} else {
			$this->Flash->error(__("Please, wait {$this->_options['expire']} to try login again!'));
		}
	} else {
		if ($this->RBruteForce->isIpBanned($this->_options)) {
			$this->Flash->error(__("Please, wait {$this->_options['expire']} to try login again!'));
		}
	}
}
```

That is all! :)

Options
-------

[](#options)

You could use options to alter the default behaviour.

```
$options = [
	'maxAttempts' => 4,			 //max failed attempts before banning
	'expire' => '3 minutes',	 //expiration time
	'dataLog' => false,			 //log the user submitted data
	'attemptLog' => 'beforeBan', //all|beforeBan
	'checkUrl' => true,			 //check url or not
	'cleanupAttempts' => 1000,	 //delete all old entries from attempts database if there are more rows that this
	'urlToRedirect'     => '/r_brute_force/Rbruteforces/failed' //url to redirect if failed.
	];
$this->RBruteForce->check($options);
```

You do not have to include options where default value is good for you. For example.

```
$this->RBruteForce->check(
		[
		'maxAttempts' => 3,
		'attemptLog' => 'all'
		]
	);
```

### maxAttempts

[](#maxattempts)

Users will banned after this many unsuccessful attempts. Normally 3-5 should be enough.

### expire

[](#expire)

The ban will exists for this time. This should be something like:

- 20 seconds
- 5 minutes
- 1 hour
- 2 days
- 3 weeks
- 1 month

### dataLog

[](#datalog)

If this option is set to `true` the user submitted data will be saved to the plugin's database. You could analize this data any time you want.

### attemptLog

[](#attemptlog)

There are two valid values; `all` and `beforeBan`

If you choose `all` than all attempts will be logged into the plugins database. If you choose `beforeBan` only attempts before banning will be logged.

### checkUrl

[](#checkurl)

Shoud the plugin include the url into the brute force check or not.

If set to `false` and somebody try to login at `/users/login` and than at `/admin/users/login`the plugin will count as they would be the same url. If set to `true` the plugin will se thw two above as different attempts.

### cleanupAttempts

[](#cleanupattempts)

When you suffer a brute force attack you could have thousands of log entries in the database in a few minutes. If you want to limit how much data should be stored you could use this option. Normally you should not worry about this till you have less than a million record.

How does it work?
-----------------

[](#how-does-it-work)

When a user (or an automated attack) send some data to login (or any other) function CakePHP will call your controller's corresponding method. In this method you should have

```
$this->RBruteForce->check();
```

This method calls the plugin and it will log every attempts. It checks the plugin database for the clients IP address. If there are more entries there within the given expiration the plugin bans the request, logs the attempt and redirect the user to the failed login page. Automated attacks will see this as a successful login.

On every failed attempt the plugin delays the rendering of the page with an extra 1 second. So after 3 attempts the rendering will be delayed with 3 seconds. This slows down automated attacks, and just a little inconvinience for real users.

If an IP address is banned and you `check` *before* user authentication the plugin will not let the user get in even with valid username and password.

To remove the ban before expire you should browse to `/r_brute_force/rbruteforces` and delete the ban manually. Alternatively you just wait till the ban expires.

Submitted data entries available at `/r_brute_force/rbruteforcelogs`.

Warning
-------

[](#warning)

This is not a firewall! If you use this plugin you are still open to brute force attacks. Slow attacks involving proxies are really hard to detect. If you want protection agains them you should write your own protection methods, like limiting user accounts after a few attempts, or asking for extra login data like security question, or whitelist IP-s from where admins could log in, or other ideas. In the same time you could ban top attempt sources on your server firewall. This information is available at `/r_brute_force/rbruteforces`. Be careful to not to ban out proxies used by legitim users.

###  Health Score

30

—

LowBetter than 64% of packages

Maintenance20

Infrequent updates — may be unmaintained

Popularity14

Limited adoption so far

Community13

Small or concentrated contributor base

Maturity64

Established project with proven stability

 Bus Factor2

2 contributors hold 50%+ of commits

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~240 days

Recently: every ~287 days

Total

8

Last Release

1485d ago

Major Versions

2.5 → 3.02022-04-13

### Community

Maintainers

![](https://www.gravatar.com/avatar/24e99729583abb961401bfb8e2d3f8f080469273f42105495961056890cc81a9?d=identicon)[elsoncosta](/maintainers/elsoncosta)

---

Top Contributors

[![rrd108](https://avatars.githubusercontent.com/u/3147489?v=4)](https://github.com/rrd108 "rrd108 (19 commits)")[![elsongabriel](https://avatars.githubusercontent.com/u/7812282?v=4)](https://github.com/elsongabriel "elsongabriel (17 commits)")[![ja1goncalves](https://avatars.githubusercontent.com/u/35072234?v=4)](https://github.com/ja1goncalves "ja1goncalves (3 commits)")[![slamkajs](https://avatars.githubusercontent.com/u/541593?v=4)](https://github.com/slamkajs "slamkajs (1 commits)")

---

Tags

securitycakephpbrute forcebruteforceegcservices

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/egcservices-rbruteforce2/health.svg)

```
[![Health](https://phpackages.com/badges/egcservices-rbruteforce2/health.svg)](https://phpackages.com/packages/egcservices-rbruteforce2)
```

###  Alternatives

[maba/gentle-force-bundle

Symfony bundle that integrates gentle-force library for limiting both brute-force attempts and ordinary requests, using leaky/token bucket algorithm, based on Redis

53517.6k1](/packages/maba-gentle-force-bundle)[maba/gentle-force

Library for limiting both brute-force attempts and ordinary requests, using leaky/token bucket algorithm, based on Redis

45591.0k2](/packages/maba-gentle-force)[anyx/login-gate-bundle

Checking brute force attacks on site

59339.5k](/packages/anyx-login-gate-bundle)[codeconsortium/ccdn-user-security-bundle

CCDN User Security Bundle

60100.7k](/packages/codeconsortium-ccdn-user-security-bundle)[websoftwares/throttle

Ban identifier after certain amount of requests in a given timeframe.

1249.7k](/packages/websoftwares-throttle)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)