README

Comprehensive security suite for Laravel, the Wordfence equivalent.

WAF + scanner + ACL + audit log + live traffic + notifications, all configurable, all auditable, all Laravel-native.

Brand site: laravel-shield.ozankurt.com, docs, pricing, license activation.

Why Laravel Shield

Install

composer require ozankurt/laravel-shield
php artisan shield:install

shield:install publishes config + migrations + lang + assets, runs migrations, seeds lookup tables + ~47 built-in WAF rules + ~33 built-in malware signatures, generates LS_AUDIT_HMAC_SECRET + LS_BYPASS_KEY if missing, and optionally whitelists your current IP so you don't lock yourself out.

Then expose the dashboard by allowing the gate it defines:

// AppServiceProvider::boot()
Gate::define('viewShieldDashboard', fn ($user) => $user && $user->is_admin);

Visit /shield.

Quickstart middlewares

In your route file or middleware group, attach what you need:

Route::middleware('firewall.all')->group(function () {
    Route::post('/login', LoginController::class);
});

Route::post('/api/upload', UploadController::class)
    ->middleware(['firewall.av_uploads', 'throttle:shield_login']);

Route::middleware(['firewall.acl', 'firewall.headers'])->group(function () {
    // Public site with security headers + ACL evaluation
});

Configuration

After install, see config/shield.php. Every limit, threshold, regex, path, and behaviour is exposed. Highlights:

// Storage strategy (sync default; queue/redis_batch for high traffic)
'storage' => ['driver' => env('LS_STORAGE_DRIVER', 'sync'), 'sample_rate' => ['live_traffic' => 0.1]],

// Audit log with HMAC chain tamper evidence
'audit' => ['drift' => ['enabled' => true, 'paths' => ['config/' => '*.php', '.env' => null]]],

// Scanner with ClamAV (composer suggest xenolope/quahog)
'scanner' => ['clamav' => ['enabled' => env('LS_CLAMAV_ENABLED', false)]],

// Three-layer bypass for admin lockout recovery
'bypass' => ['ips' => array_filter(explode(',', env('LS_BYPASS_IPS', '')))],

// Beyond-WF extras (all opt-in)
'headers' => ['enabled' => true, 'csp' => ['enabled' => false, 'use_nonce' => true]],
'honeypot' => ['enabled' => false, 'paths' => ['wp-admin', '.env', 'phpmyadmin', '.git/config']],
'scoring' => ['enabled' => false, 'threshold' => 100, 'window' => 3600],

Documentation

Premium tier

Premium features live in the same package, gated by LS_PREMIUM_LICENSE_KEY at runtime. No separate composer repo, no Satis, no auth tokens. Buy at laravel-shield.ozankurt.com, paste the key into .env, premium features activate on next request.

Premium unlocks:

• Real-time threat feed sync (free tier syncs daily; premium polls every few minutes)
• Real-time IP blocklist subscription
• Hosted audit-log sink (forward audit events to the Shield Central app for cross-site aggregation)
• Future SIEM dashboard integration

The license check is honest soft-enforcement (see docs/premium.md, the real moat is the API services Ozan hosts, which patching the local check can't unlock).

Companion packages

• ozankurt/laravel-shield-filament, Filament panel adapter. v1.x for Filament 3 + 4, v2.x for Filament 5+. (Ships post-1.0.)
• ozankurt/laravel-shield-signatures, Public GitHub repo of malware signatures. shield:signatures-sync pulls from here.

License

MIT, see LICENSE.md.