PHPackages                             xlock/laravel - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. xlock/laravel

ActiveLibrary[Security](/categories/security)

xlock/laravel
=============

x-lock bot protection middleware for Laravel

0.1.0(1mo ago)00MITPHPPHP >=8.1

Since Apr 5Pushed 1mo agoCompare

[ Source](https://github.com/xlock-dev/xlock-laravel)[ Packagist](https://packagist.org/packages/xlock/laravel)[ Docs](https://x-lock.dev)[ RSS](/packages/xlock-laravel/feed)WikiDiscussions main Synced 1mo ago

READMEChangelog (1)Dependencies (2)Versions (2)Used By (0)

xlock/laravel
=============

[](#xlocklaravel)

Laravel middleware for [x-lock](https://x-lock.cloud) bot protection.

Requirements
------------

[](#requirements)

- PHP >= 8.1
- Laravel 10, 11, or 12

Installation
------------

[](#installation)

```
composer require xlock/laravel
```

The service provider is auto-discovered. To publish the config file:

```
php artisan vendor:publish --tag=xlock-config
```

Add your site key to `.env`:

```
XLOCK_SITE_KEY=sk_your_site_key

```

Usage
-----

[](#usage)

Apply the `xlock` middleware to any routes you want to protect:

```
Route::middleware('xlock')->group(function () {
    Route::post('/login', [AuthController::class, 'login']);
    Route::post('/register', [AuthController::class, 'register']);
});
```

Or apply it to a single route:

```
Route::post('/checkout', [CheckoutController::class, 'store'])->middleware('xlock');
```

Configuration
-------------

[](#configuration)

KeyEnv VariableDefaultDescription`site_key``XLOCK_SITE_KEY``null`Your x-lock site key`api_url``XLOCK_API_URL``https://api.x-lock.dev`Enforcement API endpoint`fail_open``XLOCK_FAIL_OPEN``true`Allow requests when API is unreachableHow it works
------------

[](#how-it-works)

The middleware intercepts POST requests and checks for an `x-lock` header token. It sends the token to the x-lock enforcement API for verification. If the token is missing or rejected, the request is blocked with a 403 response.

When `fail_open` is `true` (the default), requests are allowed through if the x-lock API is unreachable or returns an unexpected error.

License
-------

[](#license)

MIT

###  Health Score

32

—

LowBetter than 72% of packages

Maintenance90

Actively maintained with recent releases

Popularity0

Limited adoption so far

Community2

Small or concentrated contributor base

Maturity32

Early-stage or recently created project

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Unknown

Total

1

Last Release

46d ago

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/262658454?v=4)[linus](/maintainers/pentium-solver)[@pentium-solver](https://github.com/pentium-solver)

---

Tags

middlewarelaravelsecuritybot-protectionx-lock

### Embed Badge

![Health badge](/badges/xlock-laravel/health.svg)

```
[![Health](https://phpackages.com/badges/xlock-laravel/health.svg)](https://phpackages.com/packages/xlock-laravel)
```

###  Alternatives

[tzsk/otp

A secure, database-free One-Time Password (OTP) generator and verifier for PHP and Laravel.

241641.4k1](/packages/tzsk-otp)[mazedlx/laravel-feature-policy

Add Feature-Policy headers to the responses of a Laravel app

17180.5k](/packages/mazedlx-laravel-feature-policy)[laragear/poke

Keep your forms alive, avoid TokenMismatchException by gently poking your Laravel app

2211.5k](/packages/laragear-poke)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)