PHPackages                             kanopi/firewall - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. kanopi/firewall

ActiveLibrary[Security](/categories/security)

kanopi/firewall
===============

Evaluate the requests for malicious items.

v2.12.0(2w ago)26.1k—4.6%[14 issues](https://github.com/kanopi/firewall/issues)[1 PRs](https://github.com/kanopi/firewall/pulls)MITPHPPHP >=8.1CI failing

Since May 6Pushed 2mo ago6 watchersCompare

[ Source](https://github.com/kanopi/firewall)[ Packagist](https://packagist.org/packages/kanopi/firewall)[ RSS](/packages/kanopi-firewall/feed)WikiDiscussions 2.x Synced 2w ago

READMEChangelog (10)Dependencies (42)Versions (28)Used By (0)

Lite Firewall
=============

[](#lite-firewall)

**Lite Firewall** is a powerful, extensible request-evaluation library for PHP-based systems. It analyzes HTTP requests and applies configurable rules to allow, challenge, or block access based on IP addresses, geolocation, user agents, URLs, ASN (Autonomous System Numbers), rate limits, vulnerability scoring, and the OWASP Core Rule Set.

It is framework agnostic — it works with Drupal, WordPress, Symfony, Laravel, or any standalone PHP application.

📖 Documentation
---------------

[](#-documentation)

**Start at the [documentation index](docs/index.md).**

This README is a short introduction. Everything else — the complete configuration reference, every plugin, the shipped presets, platform integration, and the contribution guide — is in [`docs/`](docs/), and published at [kanopi.github.io/firewall](https://kanopi.github.io/firewall/).

[Getting Started](docs/getting-started/index.md)Install, configure, and block your first request[Configuration](docs/configuration/index.md)Every YAML key, with defaults[Plugins](docs/plugins/index.md)The ten built-in request evaluators[Presets](docs/presets/available.md)Ready-made rule sets you can include in one line[Guides](docs/guides/index.md)Error handling, custom plugins, custom storage, GeoIP setup[Reference](docs/reference/index.md)Rate-limit rules and the legacy config format[Contributing](docs/contributing/index.md)Development setup, tests, and the PR checklistThe docs source is the [`docs/`](docs/) directory in this repository. See [Writing Documentation](docs/contributing/documentation.md)to contribute a change.

Features
--------

[](#features)

- **Flexible Plugin System**: Modular architecture allows for easy extension and customization
- **Multiple Storage Backends**: In-memory, file-based, and database storage for blocked clients, plus in-memory, file, database, PSR-6 cache, and Redis backends for rate-limit counters — or bring your own
- **Comprehensive Request Analysis**: Evaluate requests based on IP, location, ASN, user agent, URL patterns, and more
- **OWASP Core Rule Set**: Real CRS rules (SQLi, XSS, LFI/RFI, RCE, scanners) with tunable paranoia levels
- **IP Reputation**: Turn away addresses reported to AbuseIPDB, cached to stay inside the free tier and failing open when the service is unreachable
- **Vulnerability Scoring**: Advanced risk assessment based on multiple factors with configurable thresholds
- **Rate Limiting**: Built-in rate limiting with configurable storage backends
- **Challenge Responses**: Serve a proof-of-effort interstitial instead of a hard block, with HMAC-signed, IP-bound pass tokens
- **GeoIP Integration**: Full support for MaxMind GeoIP2 databases (both local and web service)
- **Advanced Conditional Logic**: Support for simple, complex, and grouped conditional rules
- **Escalating Bans**: Repeat offenders can be banned for progressively longer, up to permanently
- **Remote Configuration Support**: Load configuration files from remote URLs with local caching
- **PSR-3 Compatible Logging**: Integration with Monolog for flexible logging, with sensitive headers redacted by default
- **Framework Agnostic**: Works with any PHP application or framework — block, log-only, or throw exceptions for your framework to handle

Requirements
------------

[](#requirements)

- PHP 8.1 or higher
- Composer
- Optional: MaxMind GeoIP2 databases for geolocation features
- Optional: Redis for distributed rate limiting

Installation
------------

[](#installation)

```
composer require kanopi/firewall
```

Quick Start
-----------

[](#quick-start)

Place the following in your application's entry point (`index.php`, `wp-config.php`, or Drupal's `settings.php`):

```