niladam/livewire-ban
Livewire Ban
Automatically ban IP addresses that trigger Livewire exceptions a real browser never produces.
A bot that scrapes a component snapshot off your site and starts tampering with it throws exceptions no legitimate session throws. This catches them, counts strikes, bans the address, emails you, and gives you a signed link to undo it from your phone.
Install
composer require niladam/livewire-ban
Publish the migration and see what is already in force:
php artisan livewire-ban:install
Create the table:
php artisan migrate
That is the whole setup. The middleware registers itself, and every setting has a working default:
| Behaviour | Out of the box |
|---|---|
| Threshold | 3 strikes in 10 minutes, then a 1 hour ban |
| Escalation | 1h → 6h → 24h → 7d for repeat offenders inside a day |
| Alerts | One queued email per ban, capped at 10/hour |
| Undo | A signed link in every alert, good for 7 days |
Point the alerts somewhere real and you are done:
LIVEWIRE_BAN_ALERT_EMAIL=security@yourapp.com
LIVEWIRE_BAN_ALLOWLIST=203.0.113.5,10.0.0.0/8
Using Filament? One line gets you a read-only panel for reviewing and undoing bans:
$panel->plugin(\Niladam\LivewireBan\Filament\LivewireBanPlugin::make());
What it catches
Two exceptions, both of which require an attacker to have taken a real snapshot from your live site and altered it:
| Exception | What it means |
|---|---|
CorruptComponentPayloadException |
The snapshot's checksum does not match. Someone edited it in flight. |
CannotUpdateLockedPropertyException |
A #[Locked] property was targeted by an update. |
Both are configurable, and your own exceptions can join them.
Documentation
| Page | Covers |
|---|---|
| Configuration | Every setting: strikes, escalation, permanent bans, scope, exemptions, pruning |
| Extending | Hooks, events, your own model, banning by hand |
| Reference | The API, and what a ban row records |
| Design notes | Why these triggers, why this IP, why middleware |
Requirements
Laravel 13, Livewire 4, PHP 8.3 or 8.4.
Testing
composer test
License
MIT. See LICENSE.md.
Related Packages
Modern security headers for Laravel — turn-key. Strict CSP with per-request nonc...
A web-based terminal component for Filament/Laravel with command whitelisting an...
A modern CMS built on Laravel, Livewire, Alpine.js, and Filament. The TALL stack...