Download the PHP package jlrodriguezdev/laravel-bot-protection without Composer
On this page you can find all versions of the php package jlrodriguezdev/laravel-bot-protection. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download jlrodriguezdev/laravel-bot-protection
More information about jlrodriguezdev/laravel-bot-protection
Files in jlrodriguezdev/laravel-bot-protection
Package laravel-bot-protection
Short Description High-performance Laravel WAF & Anti-Bot Middleware mitigating automated scanners, scrapers, and exploit reconnaissance (including PHP2Shell)
License MIT
Informations about the package laravel-bot-protection
🛡️ Laravel BotProtection
High-Performance Web Application Firewall (WAF) & Anti-Bot Middleware for Laravel Applications
Battle-tested and running live in production at LATIRU.RU.
🌐 Choose Your Language / Выберите язык / Elige tu idioma
- 🇪🇸 Leer en Español (README.es.md) — Documentación completa en Español y caso de estudio real en producción.
- 🇬🇧 Read in English (README.md) — Full documentation in English, architecture, and production case study.
- 🇷🇺 Читать на русском (README.ru.md) — Полная документация на русском языке и разбор реальных логов атак.
🇬🇧 English - Laravel BotProtection
1. Overview & Real Production Case Study
BotProtection is a zero-dependency, battle-tested Laravel middleware designed to defend web platforms against hostile automated scrapers, exploit reconnaissance bots, and scanning toolkits.
🚀 Live Case Study from LATIRU.RU:
On October 22, 2026, our production platform LATIRU.RU came under heavy automated scanning and reconnaissance during the global wave of PHP2Shell (CVE-2026-109618 / CVE-2026-109619) attacks.
As audited in our Laravel Telescope and daily error traces, automated attacker bots bombarded the application with exploit probes:
POST /php-cgi/php-cgi.exe...-> Blocked with 405 / 403POST /api/gqlandPOST /graphql/api-> Blocked with 405 / 403GET /.env,GET /.git/config,GET /.vscode/sftp.json-> Neutralized with 404The Result: The strike system accumulated the violation counts and permanently blacklisted the offending IP addresses within 3 requests. Subsequent probes to public routes (
/,/events,/calc) were instantly dropped with403 Forbidden(errors.bot-detected), protecting our PHP workers and MySQL database from exhaustion.
2. Key Features
- Automated Scraper & Headless Tool Neutralization: Drops traffic from headless browsers, automation toolkits, and scripted probes (
curl,wget,python-requests,scrapy,selenium,webdriver,phantomjs). - Official Search Engine Whitelist: Zero false positives for legitimate search crawlers:
- Google:
googlebot,google-inspectiontool,google-extended. - Yandex:
yandexbot,yandeximages,yandexvideo,yandexsitelinks,yandexmarket,yandexaccessibility. - Bing:
bingbot,bingpreview,msnbot. - Social Previews: TelegramBot, WhatsApp, TwitterBot, Facebot.
- Google:
- Strike-Based Permanent IP Blacklisting: Probes sending invalid HTTP methods (
POST,PUT,DELETE) to sensitive root routes (/,/api,/admin) receive strikes in Cache. Upon reaching 3 violations, the IP is blacklisted automatically with an immediate 403 Forbidden. - PHP2Shell Reconnaissance Shield: Before memory corruption or RCE chains can be staged against PHP runtimes,
BotProtectiondrops the automated scanner at the application door. - Contextual Rate Limiting: IP-based decay counter returning clean 429 Too Many Requests responses under aggressive bursts.
3. Installation
Require with Composer:
Register in your application:
For Laravel 9 & 10 (app/Http/Kernel.php):
For Laravel 11 & 12 (bootstrap/app.php):
Publish Configuration & Views:
4. Configuration (config/bot-protection.php)
💡 Important Note on Whitelist Testing:
If you test the middleware by runningcurldirectly from inside the server via SSH, the request originates from127.0.0.1or the server's public IP. Because those IPs are whitelisted to prevent local Cron jobs and artisan daemons from locking themselves out, the server will legitimately return200 OK.
To test real bot blocking, run thecurlprobe from an external workstation or laptop:Or test programmatically via Tinker:
5. Architecture & Decision Flow
📄 License
MIT License. Created by jlrodriguezdev.
All versions of laravel-bot-protection with dependencies
illuminate/support Version ^9.0|^10.0|^11.0|^12.0
illuminate/http Version ^9.0|^10.0|^11.0|^12.0
illuminate/cache Version ^9.0|^10.0|^11.0|^12.0