- How do I install and configure Laraguard in a Laravel app?
- Run composer require darkghosthunter/laraguard, publish the package config and migration, and run the migration to add the 2FA columns to your users table. Then register the custom auth guard and attach the middleware to the routes you want protected. Users enroll by scanning a generated QR code and confirming a TOTP code, and they receive recovery codes for backup.
- Which Laravel and PHP versions does Laraguard support?
- The last release targeted Laravel 8 and 9 with PHP 8.0 and 8.1, which is where it installs cleanly and works as documented. It predates Laravel 10, 11, and 12, so it will not install on those versions without forking the package and widening its dependency constraints.
- Is Laraguard still maintained?
- No. The repository is archived and the most recent release was in February 2022, which predates Laravel 10, 11, and 12. There is no upstream issue triage, CVE response, or patch channel. Every fix, compatibility bump, and security patch becomes internal work with a permanent owner.
- Can I use Laraguard with Laravel 10, 11, or 12?
- Not out of the box. Expect Composer constraint conflicts on laravel/framework, illuminate/*, and possibly Carbon and the QR-code dependency. Making it work means forking the package and widening those constraints, at which point you own the authentication code. For an estate with a supported-dependencies-only policy, that is usually a blocker.
- Does Laraguard work with Google Authenticator and other authenticator apps?
- Yes. Laraguard uses standard time-based one-time passwords, so it works with Google Authenticator, Authy, 1Password, Microsoft Authenticator, and any other RFC 6238-compatible app. Enrollment is handled by scanning a generated QR code and confirming a six-digit code.
- Does Laraguard keep 2FA data on-premises, or does it call an external service?
- Entirely on-premises. TOTP secrets are stored per user in your own database and codes are verified locally, with no SaaS dependency, no per-authentication cost, and no data egress. That makes it attractive for data-residency, air-gapped, or procurement-averse environments.
- What factors does Laraguard support beyond TOTP, like recovery codes or passkeys?
- It covers TOTP codes from authenticator apps, one-time recovery codes, and optional safe-device trust so users can skip the code on known browsers. It does not offer WebAuthn, passkeys, SMS, or push. If your roadmap needs phishing-resistant factors, this package will not get you there.
- What should I audit before putting Laraguard on the login path in production?
- Independent review should cover TOTP window and drift tolerance, replay of an already-used code, and recovery-code one-time use plus whether codes are hashed or stored in plaintext. Check rate-limiter behavior when the cache is unavailable, and verify secret encryption at rest and behavior during APP_KEY rotation. Also confirm that safe-device trust cookies and attempt counters behave consistently across web and worker nodes with your chosen cache driver.
- What are the alternatives to Laraguard for two-factor authentication in Laravel?
- Laravel Fortify provides maintained TOTP two-factor authentication with recovery codes and confirmation flows, and it is the default choice for most new Laravel apps. If you want lower-level control, pragmarx/google2fa-laravel gives you TOTP primitives to build your own enrollment and verification. For phishing-resistant factors, look at WebAuthn or passkey packages rather than TOTP-based ones.
- Should I use Laraguard for a new Laravel project?
- Generally no. Adopting it as-is is only defensible on a Laravel 8 or 9 estate that is already pinned, with a funded and scheduled migration off it. Treat it as a bridge rather than a destination, and name a team, on-call rotation, and CI owner before you fork it. If your roadmap includes WebAuthn or passkeys, this package is a dead end regardless of maintenance status.