PHPackages justinholtweb/craft-garrison - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Security](/categories/security) 4. / 5. justinholtweb/craft-garrison ActiveCraft-plugin[Security](/categories/security) justinholtweb/craft-garrison ============================ Comprehensive security suite for Craft CMS — scanning, active protection, audit logging, and notifications. 5.1.0(1mo ago)00proprietaryPHPPHP ^8.2 Since Jun 11Pushed 5d agoCompare [ Source](https://github.com/justinholtweb/craft-garrison)[ Packagist](https://packagist.org/packages/justinholtweb/craft-garrison)[ RSS](/packages/justinholtweb-craft-garrison/feed)WikiDiscussions main Synced 1w ago READMEChangelog (6)Dependencies (4)Versions (5)Used By (0) Garrison — Security Suite for Craft CMS ======================================= [](#garrison--security-suite-for-craft-cms) Comprehensive security plugin for Craft CMS 5. Vulnerability scanning, active request protection, audit logging, file integrity monitoring, and multi-channel notifications in a single install. Editions -------- [](#editions) FeatureFreeProSecurity scanner (14 checks)✓✓Remediation guidance per check✓✓Login brute-force protection & lockout✓✓Audit logging30 days365 daysConsole commands✓✓Scan historyLast 10UnlimitedMulti-site scans✓✓Scheduled scans (queue-based)—✓Email / Slack / Discord / webhook alerts—✓IP allow/block rules (CP + frontend, CIDR)—✓Rate limiting—✓File integrity monitoring—✓REST API (authenticated)—✓WAF / request filtering—✓Geo-blocking—✓Dashboard threat analytics—✓Requirements ------------ [](#requirements) - Craft CMS 5.0.0 or later - PHP 8.2 or later Installation ------------ [](#installation) Open your terminal and run: ``` composer require justinholtweb/craft-garrison php craft plugin/install garrison ``` Or install from the Craft Plugin Store in your control panel. Configuration ------------- [](#configuration) Copy the default config to your project: ``` cp vendor/justinholtweb/craft-garrison/src/config.php config/garrison.php ``` Multi-environment config is supported. Key settings: ``` return [ '*' => [ 'maxLoginAttempts' => 5, 'lockoutDuration' => 300, 'enableAuditLog' => true, 'scanSchedule' => 'daily', ], 'production' => [ 'enableRateLimiting' => true, 'enableFileIntegrity' => true, 'enableNotifications' => true, 'emailRecipients' => ['admin@example.com'], 'slackWebhookUrl' => '$SLACK_WEBHOOK_URL', ], ]; ``` Modules ------- [](#modules) ### Scanner [](#scanner) Runs 14 security checks against your site and produces a risk score (0–100). Every check returns plain-language remediation guidance: 1. **CMS Configuration** — dev mode, admin changes, test email, elevated session duration, wildcard GraphQL origins 2. **HTTPS** — verifies the site is served over TLS 3. **CSRF Protection** — confirms CSRF tokens are enabled 4. **File Permissions** — checks `.env`, `config/`, `web/index.php` for unsafe permissions 5. **PHP Version** — flags EOL or soon-to-expire PHP versions 6. **Application Security Key** — confirms a strong `securityKey` is set 7. **Cookie Security** — `useSecureCookies` and `sameSiteCookieValue` policy 8. **Upload Sanitization** — `sanitizeSvgUploads` and `sanitizeCpImageUploads` 9. **Web Root Exposure** — sensitive files (`.env`, composer manifests, `.git`) under the public root 10. **Software Updates** — pending Craft / plugin updates (uses cached update info) 11. **GraphQL Introspection** — flags introspection left on in production 12. **X-Powered-By Header** — flags the `sendPoweredByHeader` information disclosure 13. **Session Duration** — flags unusually long authenticated sessions 14. **Admin Usernames** — flags predictable admin usernames (`admin`, `root`, …) Risk score weights: Critical (+25), High (+15), Medium (+8), Low (+3). To disable specific checks, set the `enabledChecks` array in `config/garrison.php`. ### Shield [](#shield) Active request-level protection, evaluated on `Application::EVENT_BEFORE_REQUEST`. Checks run cheapest first; control-panel traffic is exempt from rate limiting, geo-blocking, and the WAF to avoid locking out administrators: 1. **IP allow/block rules** — exact, CIDR, or wildcard patterns, scoped to CP / frontend / everywhere → 403 2. **Login lockout** — failed-attempt threshold enforced before the password is checked → 403 / 429 3. **Geo-blocking** (Pro) — block or allowlist by country, resolved from an upstream country header (Cloudflare `CF-IPCountry` by default) → 403 4. **Rate limiting** (Pro) — fixed-window per-IP counter backed by Craft's cache → 429 5. **WAF rules** (Pro) — regex signatures for SQL injection, XSS, path traversal, and malicious user agents → 403 Every block is recorded in the database and fires a `ThreatDetectedEvent`. ### Sentinel [](#sentinel) Monitoring and audit trail: - **Audit log** — records logins, failed logins, logouts, element creation/deletion, plugin install/uninstall/enable/disable, and user suspend/activate events, with the acting user, IP, and user agent - **File integrity** (Pro) — SHA-256 baselines stored in the database; detects modified, deleted, and added files across the monitored paths Default monitored paths: `vendor/craftcms/cms/src/`, `config/`, `.env`, `web/index.php`. ### Beacon [](#beacon) Multi-channel notifications (Pro), delivered via a queue job so a slow webhook never blocks a request: - **Email** — via Craft's built-in mailer - **Slack** — incoming webhook URL - **Discord** — webhook URL - **Webhook** — generic POST with a JSON payload Triggers: scan failure, threat detection, login lockout, and file integrity changes. Threat notifications are de-duplicated per IP so floods don't spam your channels. Console Commands ---------------- [](#console-commands) ``` # Run a security scan php craft garrison/scan/run php craft garrison/scan/run --siteId=1 # Show the last scan status php craft garrison/scan/status # IP management (Pro) php craft garrison/shield/block 203.0.113.4 --label="abuse" php craft garrison/shield/allow 10.0.0.0/8 --scope=cp php craft garrison/shield/list php craft garrison/shield/remove 3 # File integrity (Pro) php craft garrison/integrity/baseline php craft garrison/integrity/check ``` REST API (Pro) -------------- [](#rest-api-pro) The API is authenticated through Craft's session and permission system — callers must be signed-in control-panel users with the relevant Garrison permissions. All endpoints return JSON and live under the control-panel trigger (e.g. `/admin`). ``` GET garrison/api/v1/scan/last Last scan summary POST garrison/api/v1/scan/run Run a scan (requires "Run security scans") GET garrison/api/v1/scan/ A specific scan with full results GET garrison/api/v1/shield/status Blocked-request count and rule count GET garrison/api/v1/sentinel/log Recent audit-log entries (requires "View audit log") ``` Scheduled Scans (Pro) --------------------- [](#scheduled-scans-pro) Set `scanSchedule` to `hourly`, `daily`, `weekly`, or `monthly`. Garrison enqueues a `RunScanJob` once the interval has elapsed since the last scan; the check is throttled to run at most once a minute and only on web requests. For deterministic timing you can instead drive `php craft garrison/scan/run` from system cron. Permissions ----------- [](#permissions) PermissionDescriptionAccess GarrisonView the Garrison CP sectionRun security scansExecute manual scansView audit logAccess the Sentinel audit logManage shield rulesAdd/remove IP rules, manage file baselinesManage Garrison settingsAccess plugin settingsEvents ------ [](#events) EventClassWhen`EVENT_AFTER_SCAN``services\Scanner` (`ScanEvent`)After a scan completes`EVENT_THREAT_DETECTED``services\Shield` (`ThreatDetectedEvent`)When Shield blocks a requestWidgets ------- [](#widgets) - **Security Score** — current risk score on the Craft dashboard - **Recent Threats** — recently blocked requests Development ----------- [](#development) ``` composer test # run the unit suite (Codeception) composer ecs # check coding standard composer phpstan # static analysis (level 5) ``` License ------- [](#license) This is a commercial plugin licensed through the [Craft Plugin Store](https://plugins.craftcms.com). The Free edition is free. See [LICENSE.md](LICENSE.md). ### Health Score 40 — FairBetter than 86% of packages Maintenance96 Actively maintained with recent releases Popularity0 Limited adoption so far Community6 Small or concentrated contributor base Maturity49 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~2 days Total 4 Last Release 39d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/035cb655c55af0e9e5b96754b80fd9703e195c32dbdfc49ae9a43ab9cf8db560?d=identicon)[justinholtweb](/maintainers/justinholtweb) --- Top Contributors [![justinholtweb](https://avatars.githubusercontent.com/u/295903?v=4)](https://github.com/justinholtweb "justinholtweb (12 commits)") ### Code Quality TestsCodeception ### Embed Badge ![Health badge](/badges/justinholtweb-craft-garrison/health.svg) ``` [![Health](https://phpackages.com/badges/justinholtweb-craft-garrison/health.svg)](https://phpackages.com/packages/justinholtweb-craft-garrison) ``` ### Alternatives [spicyweb/craft-neo A Matrix-like field type with block hierarchy 393813.5k10](/packages/spicyweb-craft-neo)[verbb/formie The most user-friendly forms plugin for Craft. 101393.6k74](/packages/verbb-formie)[solspace/craft-freeform The most flexible and user-friendly form building plugin! 54681.3k21](/packages/solspace-craft-freeform)[verbb/vizy A flexible visual editor field for Craft. 4250.4k](/packages/verbb-vizy)[craftpulse/craft-password-policy Password Policy plugin 2830.6k2](/packages/craftpulse-craft-password-policy)[verbb/events A full-featured plugin for event management and ticketing. 2311.9k](/packages/verbb-events) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)