Download the PHP package wallacemartinss/filament-security without Composer

Filament Security

Security plugin for Filament v5 with eight protection layers: disposable email blocking, DNS/MX verification, RDAP domain age check, single session enforcement, honeypot bot protection, Cloudflare IP blocking, malicious scan detection, and a security event dashboard with real-time analytics.

Screenshots

Email Validation

Security Event Dashboard

Version Compatibility

Requirements

• PHP 8.2+
• Laravel 11, 12 or 13
• Filament v5

Installation

Publish the config file:

If you enable the Event Log (Layer 8) or Cloudflare IP Blocking (Layer 6), publish and run the migrations:

Tailwind CSS (required for custom views)

If you use a custom Filament theme, add the plugin's source paths to your resources/css/filament/admin/theme.css so Tailwind can scan the plugin's views and classes:

Then rebuild your theme:

Register the plugin in your AdminPanelProvider (after ->registration()):

Layer 1: Disposable Email Blocking

Blocks registration with temporary/disposable email addresses. Ships with 192,000+ built-in domains (sourced from disposable/disposable-email-domains) and supports custom domains.

Covers all major disposable email providers including Mailinator, YOPmail, GuerrillaMail (all 11 variants), TempMail, ThrowAway, Burner Mail, and thousands more.

Filament Registration Integration

When disposableEmailProtection() is enabled, the plugin automatically replaces the default Filament registration page with a secured version that validates emails against the disposable domain list. No extra configuration needed.

The plugin only replaces the default Register::class. If you have a custom registration page, use the trait instead:

Usage as Validation Rule

Usage in Filament Forms

Programmatic Check

Managing Custom Domains

Configuration

Domain Sources (priority order)

Layer 2: DNS/MX Verification

Verifies that the email domain has valid mail infrastructure. Blocks domains that cannot receive email — domains with no MX records and no A/AAAA fallback, or domains with MX records pointing to suspicious targets (localhost, private IPs).

How it works

Enabled by default

DNS/MX verification is enabled by default. No extra setup required.

Usage as Validation Rule

Programmatic Check

Configuration

What is detected

Layer 3: Domain Age Verification (RDAP)

Checks the domain registration age via RDAP (Registration Data Access Protocol). Blocks recently registered domains — a common pattern in spam, phishing, and fraud campaigns.

Disabled by default

This feature makes external HTTP calls to RDAP servers. Enable it via .env:

Usage as Validation Rule

Programmatic Check

Configuration

Failure behavior

Layer 4: Single Session Enforcement

Ensures only one active session per user. When a user logs in from a new browser or device, all previous sessions are immediately terminated. Works with database, Redis, and file session drivers.

How it works

Disabled by default

Session driver support

Programmatic Usage

Configuration

Layer 5: Honeypot Protection

Protects registration forms against bots using invisible honeypot fields. Powered by spatie/laravel-honeypot.

Two invisible fields are injected into the registration form:

1. Empty field - Bots auto-fill all fields; if this field has a value, the submission is rejected
2. Timestamp field - Tracks how fast the form was submitted; instant submissions are rejected

Enabled by default

Custom Registration Page

When spam is detected, the request is aborted with 403 Forbidden. A SpamDetectedEvent is also fired for logging or IP blocking (Layer 6).

Layer 6: Cloudflare IP Blocking

Automatically blocks suspicious IPs on Cloudflare WAF after repeated failed login attempts or bot detection via honeypot.

Real client IP resolved through: CF-Connecting-IP > X-Real-IP > X-Forwarded-For > REMOTE_ADDR

Setup

1. Add your Cloudflare credentials to .env:

2. Publish and run the migration:

3. Enable in the plugin:

How to get your Cloudflare credentials

API Token

1. Go to Cloudflare Dashboard > My Profile > API Tokens
2. Click "Create Token" > "Create Custom Token"
3. Permissions: Zone > Firewall Services > Edit
4. Zone Resources: Include > Specific zone > select your domain

Zone ID

1. Go to Cloudflare Dashboard and select your domain
2. On the Overview page, scroll down to the right sidebar > API section > copy Zone ID

Managing Blocked IPs

Programmatic Usage

Configuration

Layer 7: Malicious Scan Protection

Detects and blocks requests to known exploit paths, config files, web shells, and CMS admin pages. Returns 404 and logs the attempt as a security event.

What is detected

Disabled by default

The middleware is automatically registered in the web middleware group when enabled.

Configuration

Layer 8: Security Event Dashboard

A complete Filament resource that records and visualizes all security events across every layer. Provides a real-time dashboard with stats, charts, and a threat intelligence table.

What is recorded

Every layer in the plugin automatically records events when the Event Log is enabled:

Setup

1. Enable in .env:

2. Publish and run the migration:

3. Enable in the plugin:

Dashboard features

The Security Events page includes:

Header Widgets (4 stat cards):

• Events Today (with trend vs yesterday + 7-day mini chart)
• IPs Blocked Today
• Top Threat (7 days)
• Unique IPs (7 days)

Tabs (filtered by category):

• Email — disposable emails, DNS/MX, domain age
• Bots & Scans — honeypot, malicious scans
• Session — terminated sessions
• Auth — login lockouts
• IP Management — blocked/unblocked IPs

Footer Widgets (3 charts):

• Threat Activity (14-day line chart by category)
• Events by Type (7-day doughnut chart)
• Top Offending IPs (table with top 10 attackers, event count, location, ban status)

Table features:

• Live polling every 30 seconds
• Dynamic columns per tab (email, path, user_agent, trigger info)
• Copyable IP badges
• Country flags with city/org tooltip
• Type filter (multi-select)

Actions:

• Backfill IP Locations — header action to enrich IPs without geolocation via IpInfo API
• Unban IP — row action to remove Cloudflare block directly from the table

Programmatic Usage

Configuration

IpInfo Integration (Optional)

Enrich security events with IP geolocation data (country, city, organization) from ipinfo.io. This is completely optional — if no token is provided, everything works without geolocation.

Setup

1. Get a free API token at ipinfo.io/signup
2. Add to .env:

How it works

• When a security event is recorded, the IP is automatically enriched with country, city, and org data
• Results are cached for 24 hours per IP to minimize API calls
• The Backfill Locations action in the dashboard lets you retroactively enrich existing events
• If the token is not set, geolocation is silently skipped

Configuration

Environment Variables

Testing

Translations

The package includes translations in 15 languages: English, Brazilian Portuguese, German, Spanish, French, Italian, Japanese, Korean, Dutch, Polish, Russian, Turkish, Ukrainian, Arabic, and Chinese (Simplified).

To publish translations:

License

MIT License. See LICENSE for details.