Weave Code
Firewall Laravel Package
akaunting/firewall
Akaunting Firewall is a Laravel middleware package that helps protect your app from malicious traffic. It provides IP blacklisting and whitelisting, request filtering, attack detection, and security logging, with configurable rules to block threats before they reach your application.
Web Application Firewall (WAF) package for Laravel
Frequently asked questions about Firewall
- What is akaunting/firewall used for in a Laravel application?
- It is a Web Application Firewall delivered as Laravel middleware. It inspects incoming requests before they reach your application and can block traffic using IP blacklists and whitelists, request filtering, and attack detection. It also writes security logs so you can see what was blocked and why. You add it to your middleware stack rather than running a separate proxy or appliance.
- How do I install akaunting/firewall with Composer?
- Install it with composer require akaunting/firewall from your Laravel project root. Composer resolves a version compatible with your Laravel and PHP versions, so check that the resolved constraint matches what you expect. After installing, register the middleware in your HTTP kernel or bootstrap file and publish the configuration if you need to customise rules. Always confirm the exact registration steps against the README for the version you installed.
- Which Laravel and PHP versions does akaunting/firewall support?
- The 3.0.0 release declares support for Laravel 13 and drops Laravel 9 along with PHP 8.0 and 8.1. That puts the practical floor at a current PHP 8.2+ runtime, and you should confirm from the package composer.json whether Laravel 10, 11, and 12 remain supported or whether 3.x narrows to Laravel 13 only. The package's stated policy is to track Laravel's own support window rather than carrying legacy branches.
- Is upgrading to akaunting/firewall 3.0.0 a breaking change?
- The 3.0.0 tag is a framework-alignment release: the changes are dependency constraint updates rather than API or behaviour changes, so no migrations or code rewrites are expected. Because it is a major version, Composer will not resolve it silently, which is the desired outcome. Treat it as a routine bump in terms of effort but as a major in change control. The real gating factor is whether your app already runs Laravel 10+ on PHP 8.2+.
- Can I use akaunting/firewall on a Laravel 9 application?
- Not with 3.x, which explicitly drops Laravel 9 and PHP 8.0 to 8.1. If you are pinned to Laravel 9 you would need to stay on the 2.x line, and you should confirm with the vendor how long that branch receives security fixes. In practice the package upgrade is the tail end of a runtime and framework upgrade: move PHP first, then Laravel to 10+, then the package. Any other ordering will simply fail to resolve.
- How does IP blacklisting and whitelisting work in this package?
- You maintain lists of addresses that should always be blocked and addresses that should always be allowed, and the middleware evaluates each request against them before your application code runs. Whitelisting is useful for office ranges, uptime monitors, and internal services so they are never caught by a rule. Both lists are configuration-driven, so you can manage them per environment without shipping code changes.
- Does akaunting/firewall log blocked requests and attacks?
- Yes, security logging is one of the package's stated features, so blocked requests and detections are recorded for review. That gives you an audit trail for incident response and a way to spot rules that are producing false positives. Where those entries land depends on your Laravel logging configuration, so check how the package channels its output in your environment.
- Can I customise the firewall rules and blocked response?
- The package is built around configurable rules, so you define what counts as malicious traffic for your application instead of accepting a fixed ruleset. Configuration is published into your Laravel config directory, letting you tune detection, manage IP lists, and adjust behaviour per environment. A sensible rollout is to run in observation mode first, review what gets flagged, then enable active blocking once you trust the rules.
- How much latency does a Laravel WAF middleware add in production?
- It runs in-process as middleware, so there is no extra network hop, proxy, or sidecar to operate. The per-request cost is the rule evaluation itself, which is usually small relative to database and application work, but it does scale with how many rules and IP entries you configure. Keep the lists and rules lean and benchmark against your own traffic before assuming the overhead is negligible.
- Is akaunting/firewall a replacement for Cloudflare or ModSecurity?
- No. It is application-layer middleware running inside your Laravel process, so it can only see traffic that already reached PHP. It works well as a lightweight first line of defence and as a complement to an edge or network WAF. If you need protection against volumetric attacks or filtering before requests hit your server, keep that at the CDN or proxy layer.
Weaver
How can I help you explore Laravel packages today?