PHPackages                             red-lolik/yii2-guest-rate-limiter - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. red-lolik/yii2-guest-rate-limiter

ActiveYii2-behavior[Security](/categories/security)

red-lolik/yii2-guest-rate-limiter
=================================

Rate limiter for guest users by IP address for Yii2 framework

1.0.0(1mo ago)00MITPHPPHP >=8.0

Since Jun 12Pushed 1mo agoCompare

[ Source](https://github.com/Red-Lolik/yii2-guest-rate-limiter)[ Packagist](https://packagist.org/packages/red-lolik/yii2-guest-rate-limiter)[ RSS](/packages/red-lolik-yii2-guest-rate-limiter/feed)WikiDiscussions main Synced 1w ago

READMEChangelog (1)Dependencies (1)Versions (2)Used By (0)

Yii2 Guest Rate Limiter
=======================

[](#yii2-guest-rate-limiter)

Forked, simplified and actualized from `andrey-tm/yii2-ip-ratelimiter`.

🚀 Introduction
--------------

[](#-introduction)

Simple and powerful rate limiting for guest (unauthenticated) users in Yii2.

By default, Yii2's built-in RateLimiter filter heavily relies on the User component and the `RateLimitInterface`. This makes it unnecessarily complex — and often broken — when you need to rate-limit guests based on IP address or custom fingerprint.

This package solves that problem. It allows you to apply rate limits to guest requests without modifying your User model, without forcing authentication, and with minimal configuration.

🎯 Features
----------

[](#-features)

- **Guest‑first design** – Works out of the box for unauthenticated users.
- **IP‑based rate limiting** – Uses real client IP (supports `X-Forwarded-For`).
- **No User model changes** – No need to implement `getRateLimit()` or `loadAllowance()`.
- **Pluggable storage** – Uses Yii2's `cache` component (Redis, Memcached, File, etc.) by default.
- **Standard rate limit headers** – Automatically returns:
    - `X-Rate-Limit-Limit`
    - `X-Rate-Limit-Remaining`
    - `X-Rate-Limit-Reset`
- **Customizable key** – Use a custom string to generate your own fingerprint (e.g., IP + User-Agent).
- **PSR-12 friendly** – Works with Yii2 REST and web controllers.

📦 Installation
--------------

[](#-installation)

```
composer require red-lolik/yii2-guest-rate-limiter
```

⚡ Quick Start
-------------

[](#-quick-start)

1. Configure cache component.
    Make sure your application has a cache component configured (e.g., Redis, File).
    The package will use `Yii::$app->cache` automatically.

```
// config/web.php
'components' => [
    'cache' => [
        'class' => 'yii\redis\Cache',
        'redis' => [
            'hostname' => 'localhost',
            'port' => 6379,
            'database' => 0,
        ],
    ],
];
```

2. Attach behavior to any controller

```
use RedLolik\yii2GuestRateLimiter\GuestRateLimiter;

class ApiController extends \yii\rest\Controller
{
    public function behaviors()
    {
        $behaviors = parent::behaviors();
        $behaviors['guestRateLimiter'] = [
            'class' => GuestRateLimiter::class,
            'rateLimit' => 5,
            'timePeriod' => 600,
            'actions' => ['sign-in'],
        ];

        return $behaviors;
    }
}
```

That's it! Guests (unauthenticated users) will now be rate-limited by their IP address.

🔧 Advanced Configuration
------------------------

[](#-advanced-configuration)

```
'guestRateLimiter' => [
    'class' => GuestRateLimiter::class,
    'cache' => 'redisCache', // Custom cache component.
    'separateUsers' => true, // ⚠️ Your UserIdentity model should implement RateLimitInterface.
    'cacheKey' => Yii::$app->request->queryString, // Custom cache key.
    'actions' => ['sign-in'], // Array of action names to which the behavior applies. Applies to all actions if empty.
    'rateLimit' => 5, // Maximum number of queries per time period.
    'timePeriod' => 600, // Time period in seconds.
]
```

🧪 Real-World Use Cases Identified From Developer Questions
----------------------------------------------------------

[](#-real-world-use-cases-identified-from-developer-questions)

Problem from forums / Stack OverflowThis package solution"RateLimiter only works for logged-in users"Works without Yii::$app->user->id"I get 401 errors when trying to limit guests"No authentication required"My User model doesn't implement getRateLimit()"No changes to User model"Rate limiting resets across multiple servers"Uses central cache (Redis ready)"How to limit by IP for contact form spam?"Ready with 3 lines of config📋 Requirements
--------------

[](#-requirements)

- PHP 8.0 or later
- Yii2 >= 2.0.0

🤝 Contributing
--------------

[](#-contributing)

Issues and pull requests are welcome. Please report any bugs or feature requests via GitHub Issues.

📄 License
---------

[](#-license)

This package is open-sourced software licensed under the MIT license.

###  Health Score

35

—

LowBetter than 77% of packages

Maintenance90

Actively maintained with recent releases

Popularity0

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity38

Early-stage or recently created project

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Unknown

Total

1

Last Release

46d ago

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/4174845?v=4)[Red-Lolik](/maintainers/Red-Lolik)[@Red-Lolik](https://github.com/Red-Lolik)

---

Top Contributors

[![Red-Lolik](https://avatars.githubusercontent.com/u/4174845?v=4)](https://github.com/Red-Lolik "Red-Lolik (1 commits)")

---

Tags

securityrate-limiteryii2throttleguest

### Embed Badge

![Health badge](/badges/red-lolik-yii2-guest-rate-limiter/health.svg)

```
[![Health](https://phpackages.com/badges/red-lolik-yii2-guest-rate-limiter/health.svg)](https://phpackages.com/packages/red-lolik-yii2-guest-rate-limiter)
```

###  Alternatives

[craftcms/cms

Craft CMS

3.6k3.6M3.2k](/packages/craftcms-cms)[maba/gentle-force-bundle

Symfony bundle that integrates gentle-force library for limiting both brute-force attempts and ordinary requests, using leaky/token bucket algorithm, based on Redis

51538.9k1](/packages/maba-gentle-force-bundle)[skeeks/cms

SkeekS CMS — control panel and tools based on php framework Yii2

13725.8k63](/packages/skeeks-cms)[websoftwares/throttle

Ban identifier after certain amount of requests in a given timeframe.

1252.1k](/packages/websoftwares-throttle)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)