PHPackages imransaleem/security-suite - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Security](/categories/security) 4. / 5. imransaleem/security-suite ActiveLibrary[Security](/categories/security) imransaleem/security-suite ========================== Laravel security package: audit logs, login logs, password policy, login lockout, idle timeout, HTTP logging, Bootstrap admin menu, and login-flow security. v1.1.0(1mo ago)08MITBladePHP ^7.4|^8.0 Since Jun 15Pushed 1mo agoCompare [ Source](https://github.com/imransaleem25/security-suite)[ Packagist](https://packagist.org/packages/imransaleem/security-suite)[ Docs](https://github.com/imransaleem25/security-suite)[ RSS](/packages/imransaleem-security-suite/feed)WikiDiscussions main Synced 1w ago READMEChangelogDependencies (8)Versions (3)Used By (0) Security Suite — Laravel Security Package ========================================= [](#security-suite--laravel-security-package) [![Latest Version on Packagist](https://camo.githubusercontent.com/963e43f0dfeb27579dee717c2a694a5c1483963bd1d8375f2ca828bb05a18836/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f696d72616e73616c65656d2f73656375726974792d73756974652e737667)](https://packagist.org/packages/imransaleem/security-suite)[![License](https://camo.githubusercontent.com/51578e13eec8981a78104a4944a62adfcf10e1df7a6fe336bbae0401ce92174b/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f6c2f696d72616e73616c65656d2f73656375726974792d73756974652e737667)](LICENSE) A plug-and-play Laravel package for audit logging, password policy, login lockout, idle session timeout, password history UI, and optional HTTP request logging. --- Features -------- [](#features) FeatureDescription**Audit Logs**Track create/update/delete actions with before/after diff**Password Policy**Complexity rules, expiry, history (prevent reuse of last N passwords)**Login Block**Auto-block after N failed attempts — temporary lock or admin unblock**Idle Timeout**End session after inactivity (server middleware + optional client ping)**Password History UI**Admin views for per-user and global password change history**HTTP Logger**Optional request/response logging with admin viewer**Login Logs**Failed login, login, and logout event tracking with admin UI**Logs Menu**Bootstrap dropdown or sidebar menu, env-configurable**Login Flow Security**Security headers + pre-login block checks via middleware--- Requirements ------------ [](#requirements) - PHP 7.4+ with `ext-json` - Laravel 8, 9, or 10 - [spatie/laravel-permission](https://github.com/spatie/laravel-permission) suggested for admin UI routes (`role` middleware) --- Installation ------------ [](#installation) ``` composer require imransaleem/security-suite ``` ### Publish & migrate [](#publish--migrate) ``` php artisan vendor:publish --tag=security-suite-config php artisan vendor:publish --tag=security-suite-migrations php artisan vendor:publish --tag=security-suite-views # optional php artisan vendor:publish --tag=security-suite-assets # idle-timeout.js php artisan migrate ``` See [TESTING.md](TESTING.md) for local path-repository setup and the included demo app. ### Middleware (`app/Http/Kernel.php`) [](#middleware-apphttpkernelphp) ``` protected $middlewareGroups = [ 'web' => [ // ... \ImranSaleem\SecuritySuite\Middleware\CheckPasswordExpiry::class, \ImranSaleem\SecuritySuite\Middleware\CheckIdleTimeout::class, // optional: // \ImranSaleem\SecuritySuite\Middleware\LogHttpRequest::class, ], ]; ``` ### User model [](#user-model) Add to `$fillable` and `$casts`: ``` 'login_attempts', 'locked_until', 'is_blocked', 'password_changed_at', 'forced_change_password', ``` ``` 'locked_until' => 'datetime', 'is_blocked' => 'boolean', 'forced_change_password' => 'boolean', ``` ### Host app layout [](#host-app-layout) Admin views use `config('security_suite.layout')` (default `layouts.app`). The password-expired screen uses `security_suite.password_expired_layout` (default `layouts.guest`). ### Logs menu (Bootstrap) [](#logs-menu-bootstrap) Add to your navbar or sidebar (mode is controlled by `SECURITY_SUITE_MENU_MODE`): ``` @includeWhen(config('security_suite.menu.enabled'), 'security-suite::partials.logs-menu-wrapper') ``` Or pick a template explicitly: ``` @include('security-suite::partials.logs-menu') {{-- navbar dropdown --}} @include('security-suite::partials.logs-menu-sidebar') {{-- sidebar list --}} ``` ### Idle timeout script [](#idle-timeout-script) Publish the asset once, then include in your app layout: ``` php artisan vendor:publish --tag=security-suite-assets ``` ``` @include('security-suite::partials.idle-timeout-script') ``` Requires a `#logout-form` in the layout (standard Laravel Breeze/Jetstream pattern). ### Login flow security [](#login-flow-security) Apply to login/register/password routes in `routes/web.php`: ``` Route::middleware(['guest', 'login.security'])->group(function () { // login, register, password reset routes }); ``` Or add `\ImranSaleem\SecuritySuite\Middleware\SecureLoginFlow::class` to those routes in your auth scaffold. Login, logout, and failed attempts are logged automatically via Laravel auth events when `LOGIN_LOGGING_ENABLED=true`. --- Routes ------ [](#routes) All package routes are prefixed (default `/security`): Route namePath`idle.ping``GET /security/idle-ping``idle.config``GET /security/idle-config``password.expired``GET /security/password-expired``audit.logs.index``GET /security/audit-logs``password.change.logs``GET /security/password-change-logs``login.logs.index``GET /security/login-logs``login.failed.logs``GET /security/failed-login-logs``http.logs.index``GET /security/http-logs`Change the prefix with `SECURITY_SUITE_ROUTE_PREFIX` in `.env`. --- Configuration ------------- [](#configuration) ### `.env` [](#env) ``` SECURITY_SUITE_ROUTE_PREFIX=security SECURITY_SUITE_LAYOUT=layouts.app SECURITY_SUITE_PASSWORD_EXPIRED_LAYOUT=layouts.guest SECURITY_SUITE_HOME_ROUTE=dashboard SECURITY_SUITE_LOGIN_ROUTE=login SECURITY_SUITE_IDLE_TIMEOUT=15 SECURITY_SUITE_MENU_ENABLED=true SECURITY_SUITE_MENU_MODE=dropdown SECURITY_SUITE_MENU_LABEL=Logs SECURITY_SUITE_MENU_AUDIT=true SECURITY_SUITE_MENU_PASSWORD_HISTORY=true SECURITY_SUITE_MENU_FAILED_LOGIN=true SECURITY_SUITE_MENU_LOGIN_LOGOUT=true SECURITY_SUITE_MENU_HTTP=true LOGIN_BLOCK_MODE=temporary LOGIN_MAX_ATTEMPTS=5 LOGIN_LOCKOUT_MINUTES=15 LOGIN_LOGGING_ENABLED=true LOGIN_FLOW_SECURITY_ENABLED=true LOGIN_FORCE_HTTPS=true LOGIN_AUTO_BLOCK_VIA_EVENTS=true LOGIN_ROUTE_NAMES=login,register,password.request,password.reset PASSWORD_MIN_LENGTH=12 PASSWORD_EXPIRY_DAYS=30 PASSWORD_HISTORY_COUNT=2 AUDIT_VIEWER_ROLE=admin HTTP_LOGGER_ENABLED=true ``` ### Custom modules & actions [](#custom-modules--actions) Publish `config/audit.php` and set: - `modules` — filter dropdown list; leave `[]` to load modules from the database - `actions` — allowed query filters; leave `[]` to allow any action ### Idle timeout (client-side) [](#idle-timeout-client-side) Prefer the published script partial (see **Idle timeout script** above). Manual inline example: ``` @auth (function () { fetch('{{ route("idle.config") }}') .then(r => r.json()) .then(cfg => { const TIMEOUT_MS = cfg.timeout_ms; const WARN_BEFORE = cfg.warn_before; let idleTimer, warnTimer; function reset() { clearTimeout(idleTimer); clearTimeout(warnTimer); fetch('{{ route("idle.ping") }}', { credentials: 'same-origin' }); warnTimer = setTimeout(() => alert('Session expiring soon!'), TIMEOUT_MS - WARN_BEFORE); idleTimer = setTimeout(() => { const form = document.getElementById('logout-form'); if (form) form.submit(); }, TIMEOUT_MS); } ['mousemove','keydown','click','scroll'].forEach(e => document.addEventListener(e, reset, { passive: true })); reset(); }); })(); @endauth ``` ### Background polling (idle) [](#background-polling-idle) Add host route names to `config/security_suite.php` → `idle_no_refresh_route_names` so polling does not reset the idle timer. --- Usage ----- [](#usage) ### Audit logging [](#audit-logging) ``` use ImranSaleem\SecuritySuite\Models\AuditLog; AuditLog::write('users', 'created', $user, [], $user->only(['name', 'email'])); AuditLog::write('orders', 'updated', $order, ['status' => 'pending'], ['status' => 'shipped']); ``` ### Login block [](#login-block) ``` use ImranSaleem\SecuritySuite\Services\LoginBlockService; if ($user && $error = $this->blocker->checkBlock($user)) { return back()->withErrors(['email' => $error]); } ``` ### Password policy [](#password-policy) ``` use ImranSaleem\SecuritySuite\Services\PasswordPolicyService; $request->validate(['new_password' => ['required', 'confirmed', $this->policy->complexityRule()]]); if ($this->policy->isReused($user, $request->new_password)) { /* ... */ } ``` --- Package structure ----------------- [](#package-structure) ``` security-suite/ ├── config/ ├── database/migrations/ ├── resources/ │ ├── js/idle-timeout.js │ └── views/ ├── routes/security.php └── src/ ├── Http/Controllers/ ├── Listeners/ ├── Middleware/ ├── Models/ ├── Services/ └── Support/ ``` --- License ------- [](#license) MIT — see [LICENSE](LICENSE). ### Health Score 37 — LowBetter than 81% of packages Maintenance93 Actively maintained with recent releases Popularity6 Limited adoption so far Community2 Small or concentrated contributor base Maturity39 Early-stage or recently created project How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~3 days Total 2 Last Release 36d ago ### Community Maintainers ![](https://avatars.githubusercontent.com/u/24649535?v=4)[imransaleem](/maintainers/imransaleem)[@ImranSaleem](https://github.com/ImranSaleem) --- Tags laravelsecuritybootstrapaudit-logpassword policyhttp-loggerlogin logidle-timeoutlogin-block ### Embed Badge ![Health badge](/badges/imransaleem-security-suite/health.svg) ``` [![Health](https://phpackages.com/badges/imransaleem-security-suite/health.svg)](https://phpackages.com/packages/imransaleem-security-suite) ``` ### Alternatives [psalm/plugin-laravel Psalm plugin for Laravel 3345.3M347](/packages/psalm-plugin-laravel)[roots/acorn Framework for Roots WordPress projects built with Laravel components. 9762.4M133](/packages/roots-acorn)[laravel/pulse Laravel Pulse is a real-time application performance monitoring tool and dashboard for your Laravel application. 1.7k15.1M136](/packages/laravel-pulse)[laravel/cashier Laravel Cashier provides an expressive, fluent interface to Stripe's subscription billing services. 2.5k30.2M151](/packages/laravel-cashier)[aedart/athenaeum Athenaeum is a mono repository; a collection of various PHP packages 255.2k](/packages/aedart-athenaeum)[laravel/mcp Rapidly build MCP servers for your Laravel applications. 77922.3M186](/packages/laravel-mcp) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)