Download the PHP package justinholtweb/craft-garrison without Composer

On this page you can find all versions of the php package justinholtweb/craft-garrison. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of justinholtweb/craft-garrison

Informations about the package craft-garrison

Garrison — Security Suite for Craft CMS

Comprehensive security plugin for Craft CMS 5. Vulnerability scanning, active request protection, audit logging, file integrity monitoring, and multi-channel notifications in a single install.

Editions

Feature Free Pro
Security scanner (14 checks) ✓ ✓
Remediation guidance per check ✓ ✓
Login brute-force protection & lockout ✓ ✓
Audit logging 30 days 365 days
Console commands ✓ ✓
Scan history Last 10 Unlimited
Multi-site scans ✓ ✓
Scheduled scans (queue-based) — ✓
Email / Slack / Discord / webhook alerts — ✓
IP allow/block rules (CP + frontend, CIDR) — ✓
Rate limiting — ✓
File integrity monitoring — ✓
REST API (authenticated) — ✓
WAF / request filtering — ✓
Geo-blocking — ✓
Dashboard threat analytics — ✓

Requirements

Installation

Open your terminal and run:

Or install from the Craft Plugin Store in your control panel.

Configuration

Copy the default config to your project:

Multi-environment config is supported. Key settings:

Modules

Scanner

Runs 14 security checks against your site and produces a risk score (0–100). Every check returns plain-language remediation guidance:

  1. CMS Configuration — dev mode, admin changes, test email, elevated session duration, wildcard GraphQL origins
  2. HTTPS — verifies the site is served over TLS
  3. CSRF Protection — confirms CSRF tokens are enabled
  4. File Permissions — checks .env, config/, web/index.php for unsafe permissions
  5. PHP Version — flags EOL or soon-to-expire PHP versions
  6. Application Security Key — confirms a strong securityKey is set
  7. Cookie Security — useSecureCookies and sameSiteCookieValue policy
  8. Upload Sanitization — sanitizeSvgUploads and sanitizeCpImageUploads
  9. Web Root Exposure — sensitive files (.env, composer manifests, .git) under the public root
  10. Software Updates — pending Craft / plugin updates (uses cached update info)
  11. GraphQL Introspection — flags introspection left on in production
  12. X-Powered-By Header — flags the sendPoweredByHeader information disclosure
  13. Session Duration — flags unusually long authenticated sessions
  14. Admin Usernames — flags predictable admin usernames (admin, root, …)

Risk score weights: Critical (+25), High (+15), Medium (+8), Low (+3).

To disable specific checks, set the enabledChecks array in config/garrison.php.

Shield

Active request-level protection, evaluated on Application::EVENT_BEFORE_REQUEST. Checks run cheapest first; control-panel traffic is exempt from rate limiting, geo-blocking, and the WAF to avoid locking out administrators:

  1. IP allow/block rules — exact, CIDR, or wildcard patterns, scoped to CP / frontend / everywhere → 403
  2. Login lockout — failed-attempt threshold enforced before the password is checked → 403 / 429
  3. Geo-blocking (Pro) — block or allowlist by country, resolved from an upstream country header (Cloudflare CF-IPCountry by default) → 403
  4. Rate limiting (Pro) — fixed-window per-IP counter backed by Craft's cache → 429
  5. WAF rules (Pro) — regex signatures for SQL injection, XSS, path traversal, and malicious user agents → 403

Every block is recorded in the database and fires a ThreatDetectedEvent.

Sentinel

Monitoring and audit trail:

Default monitored paths: vendor/craftcms/cms/src/, config/, .env, web/index.php.

Beacon

Multi-channel notifications (Pro), delivered via a queue job so a slow webhook never blocks a request:

Triggers: scan failure, threat detection, login lockout, and file integrity changes. Threat notifications are de-duplicated per IP so floods don't spam your channels.

Console Commands

REST API (Pro)

The API is authenticated through Craft's session and permission system — callers must be signed-in control-panel users with the relevant Garrison permissions. All endpoints return JSON and live under the control-panel trigger (e.g. /admin).

Scheduled Scans (Pro)

Set scanSchedule to hourly, daily, weekly, or monthly. Garrison enqueues a RunScanJob once the interval has elapsed since the last scan; the check is throttled to run at most once a minute and only on web requests. For deterministic timing you can instead drive php craft garrison/scan/run from system cron.

Permissions

Permission Description
Access Garrison View the Garrison CP section
Run security scans Execute manual scans
View audit log Access the Sentinel audit log
Manage shield rules Add/remove IP rules, manage file baselines
Manage Garrison settings Access plugin settings

Events

Event Class When
EVENT_AFTER_SCAN services\Scanner (ScanEvent) After a scan completes
EVENT_THREAT_DETECTED services\Shield (ThreatDetectedEvent) When Shield blocks a request

Widgets

Development

License

This is a commercial plugin licensed through the Craft Plugin Store. The Free edition is free. See LICENSE.md.

All versions of craft-garrison with dependencies

PHP Build Version
Package Version
Requires php Version ^8.2
craftcms/cms Version ^5.0.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package justinholtweb/craft-garrison contains the following files

Loading the files please wait ...