Download the PHP package ozankurt/laravel-security without Composer
On this page you can find all versions of the php package ozankurt/laravel-security. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download ozankurt/laravel-security
More information about ozankurt/laravel-security
Files in ozankurt/laravel-security
Package laravel-security
Short Description Comprehensive Laravel security suite — WAF, malware scanner, ACL, audit log, live traffic, and notifications. The Wordfence-equivalent for Laravel.
License MIT
Homepage https://laravel-shield.ozankurt.com
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package laravel-security
Laravel Shield
Comprehensive security suite for Laravel — the Wordfence equivalent.
WAF + scanner + ACL + audit log + live traffic + notifications, all configurable, all auditable, all Laravel-native.
Brand site: laravel-shield.ozankurt.com — docs, pricing, license activation.
Why Laravel Shield
| Need | What Shield gives you |
|---|---|
| Block malicious requests | 15+ WAF middlewares (XSS, SQLi, LFI, RFI, PHP wrappers, sessions, agents, geo, bots, keyword path filters) + DB-backed rule engine |
| Manage allow/deny lists | Unified ls_acl table — IP / CIDR / ASN / country / regex / hostname, first-match-wins evaluation, Redis-cached |
| Detect malware | Scanner with native engine + ClamAV + composer audit; quarantine + restore; signature feed sync |
| Audit-log everything | HMAC-chained ls_audit_log, file/config/composer drift detection, HasAuditLog trait for model events |
| See live traffic | Sampled ls_live_traffic table with optional real-time broadcasting (Reverb / Pusher / Ably) |
| Get alerts | Mail / Slack / Discord / Telegram / Webhook channels, severity-routed |
| Stay locked out? | Three-layer bypass (env key + config IPs + Artisan recovery commands) |
| Beyond Wordfence | Security headers + CSP nonce, honeypot routes, generalized redaction, suspicious activity scoring, HTTPS enforcement, cookie security audit, trusted-proxy auto-discovery, pre-configured rate limiters |
Install
shield:install publishes config + migrations + lang + assets, runs migrations, seeds lookup tables + ~47 built-in WAF rules + ~33 built-in malware signatures, generates LS_AUDIT_HMAC_SECRET + LS_BYPASS_KEY if missing, and optionally whitelists your current IP so you don't lock yourself out.
Then expose the dashboard by allowing the gate it defines:
Visit /shield.
Quickstart middlewares
In your route file or middleware group, attach what you need:
Configuration
After install, see config/shield.php. Every limit, threshold, regex, path, and behaviour is exposed. Highlights:
Documentation
| Topic | Doc |
|---|---|
| Installation + configuration | docs/installation.md |
| ACL evaluation + matchers | docs/acl.md |
| Audit log + HMAC chain | docs/audit-log.md |
| Scanner + ClamAV + signatures | docs/scanner.md |
| File-change watcher | docs/security-watch.md |
| Notifications + multi-cadence reports | docs/notifications.md |
| Bypass mechanism | docs/bypass.md |
| Premium tier + license | docs/premium.md |
Premium tier
Premium features live in the same package, gated by LS_PREMIUM_LICENSE_KEY at runtime. No separate composer repo, no Satis, no auth tokens. Buy at laravel-shield.ozankurt.com, paste the key into .env, premium features activate on next request.
Premium unlocks:
- Real-time threat feed sync (free tier syncs daily; premium polls every few minutes)
- Real-time IP blocklist subscription
- Hosted audit-log sink (forward audit events to the Shield Central app for cross-site aggregation)
- Future SIEM dashboard integration
The license check is honest soft-enforcement (see docs/premium.md — the real moat is the API services Ozan hosts, which patching the local check can't unlock).
Companion packages
ozankurt/laravel-shield-filament— Filament panel adapter. v1.x for Filament 3 + 4, v2.x for Filament 5+. (Ships post-1.0.)ozankurt/laravel-shield-signatures— Public GitHub repo of malware signatures.shield:signatures-syncpulls from here.
License
MIT — see LICENSE.md.
All versions of laravel-security with dependencies
laravel/framework Version ^9.0|^10.0|^11.0|^12.0
guzzlehttp/guzzle Version ^7.4
ozankurt/agent Version ^1.0
ramsey/uuid Version ^4.7
voku/anti-xss Version ~4.1.42
voku/portable-utf8 Version ^6.0.13