包简介

Laravel teapot to trap vulnerability scanners and integrate with fail2ban via HTTP 418

README 文档

README

Responds with HTTP 418 I'm a Teapot when a request hits a teapot path. Use with fail2ban to ban those IPs.

How it works

You list path patterns in config/teapot.php.
If the request path matches, the app returns 418 (via the fallback for unmatched URLs).
Your server logs 418; fail2ban reads the log and bans the IP.

Installation

composer require aureola/laravel-teapot

Nothing else to do; the package registers itself.

Configuration

Publish and edit the config:

php artisan vendor:publish --tag=teapot-config

paths is an array of regex alternatives (matched from the start of the path, case-insensitive). Escape special chars for literals: \. for a dot, \/ for a slash.

'paths' => [
    '\.env',
    '\.git\/',
    'wp-admin',
    '\.env(\..*)?',
    // ...
],

ignore_logged_in – when true, authenticated users are never treated as teapot hits.

Fail2ban

This repo includes fail2ban configs in fail2ban/:

Nginx: copy fail2ban/filter.d/nginx-teapot.conf and fail2ban/jail.d/nginx-teapot.conf to /etc/fail2ban/filter.d/ and /etc/fail2ban/jail.d/.
Apache: copy fail2ban/filter.d/apache-teapot.conf and fail2ban/jail.d/apache-teapot.conf instead. Adjust logpath in the jail if your access log is elsewhere.

Then restart fail2ban: sudo fail2ban-client restart

What the package registers

A fallback for unmatched URLs: 418 if the path matches a teapot pattern, 404 otherwise.

Statamic Compatibility

This package is compatible with Statamic CMS. When Statamic is installed, the package automatically adds the CheckTeapot middleware to the statamic.web middleware group, ensuring teapot paths are checked on all Statamic web requests.

Requirements

PHP 8.1+
Laravel 10.x, 11.x, or 12.x

License

aureola/laravel-teapot 适用场景与选型建议

aureola/laravel-teapot 是一款基于 PHP 开发的 Composer 扩展包，目前已累计 1.3k 次下载、GitHub Stars 达 2，最近一次更新时间为 2026 年 02 月 03 日，在 PHP 生态内属于活跃度较高的组件。

它主要适用于以下技术方向：「security」「laravel」「teapot」「statamic」「fail2ban」「vulnerability-scanner」等业务场景。在实际项目中，围绕这些方向常见需要落地的问题包括：接口对接、性能调优、并发安全、与既有框架（Laravel / ThinkPHP / Yii / Webman 等）的兼容适配，以及生产环境的日志埋点与稳定性保障。

我们在过去多个企业项目中使用过 aureola/laravel-teapot 或与其功能相近的方案，如果你在选型或落地过程中遇到问题，例如 版本兼容、二次改造、私有化封装、与内部系统对接、生产 BUG 排查，欢迎联系我们协助评估。

围绕 aureola/laravel-teapot 我们能提供哪些服务？

定制开发 / 二次开发

基于 aureola/laravel-teapot 在你已有业务上做功能扩展、字段裁剪、UI 适配、与内部账号 / 权限 / 日志系统的深度对接。

BUG 修复 & 性能优化

线上偶发问题、内存泄漏、慢查询、并发异常等排查修复；针对高流量场景做缓存、队列、索引层面的调优。

项目外包 & 长期维护

承接完整的项目从需求 → 设计 → 开发 → 上线 → 长期运维；也可按月提供技术保姆服务。

yvsm@zunyunkeji.com QQ：316430983 微信：yvsm316 西安尊云信息科技 · 专注 PHP / Go / 分布式系统研发

与 aureola/laravel-teapot 相关的其它包

同方向 / 同关键字的高下载量 PHP Composer 包推荐，方便对比选型：

sil/route-security-bundle 7

Provide a way to secure accesses to all routes of an symfony application.

eftec/securityonemysql 6

It's a barebone security class written on PHP

bugbuster/integrity_check 3

Contao CMS integrity check for some files

vartroth/php-security-lint 0

A PHP security linter to detect insecure functions like var_dump, print_r, and other dangerous functions in your codebase

foxtes/alfabank-rest 1

Alfabank REST API integration

cboxdk/laravel-ssrf 0

Cbox SSRF — a hardened, config-driven guard against server-side request forgery for outbound URLs in Laravel. Blocks private/reserved/cloud-metadata targets, pins DNS, and refuses redirects.

aureola/laravel-teapot

包简介

关键字：