- How do I install mulertech/scanner-ban-bundle in a Laravel application?
- Install the package with Composer by requiring mulertech/scanner-ban-bundle in your Laravel project. After installation, publish the package configuration and register its request-filtering middleware in your HTTP kernel or application bootstrap. Install in staging first, confirm the middleware is active, and then roll out to production while monitoring 403 rates during the first deployment.
- Which Laravel and PHP versions does scanner-ban-bundle support?
- The package is a Laravel/PHP middleware bundle, so check its Composer requirements against your application's PHP and Laravel versions before installing. Verify that the middleware APIs it uses match your framework version, particularly if you run older Laravel releases. Confirming the constraints in staging is the safest way to avoid surprises.
- How do I configure allowed_ips and the scanner blocklist?
- Configuration is supplied through the package config file, which includes allowed_ips plus blocklist rules for rejecting non-browser clients such as curl or requests with no User-Agent. Publish the config, adjust the allowlist and blocklist for each environment, and clear cached configuration after changes. Then verify behavior for browser traffic, curl, empty User-Agent requests, health endpoints, and self-calls.
- Does the package block curl requests and requests with an empty User-Agent?
- Yes, the blocklist can reject non-browser clients like curl and requests that arrive without a User-Agent header. The exact matching is configuration-driven, so review the published rules and test each case in staging. Keep in mind that legitimate API clients sometimes send minimal or unusual User-Agent strings and could be caught by broad rules.
- Why are loopback requests always allowed, and does that include IPv6 ::1?
- Requests originating from inside the container are treated as an invariant and are always allowed, even when allowed_ips does not list them. That supports health checks, post-deployment probes, and self-calls, and it reduces false 403 deployment failures. Confirm in your environment whether loopback detection covers both IPv4 127.0.0.1 and IPv6 ::1, and make sure external traffic cannot be classified as loopback.
- How should I configure trusted proxies so real client IPs are not mistaken for loopback?
- The package relies on your application's framework.trusted_proxies configuration so clients behind a reverse proxy or load balancer keep their real address instead of appearing as loopback. Configure trusted proxies for your specific proxy setup and test both direct-container access and proxied external access. If trusted proxies are wrong, client-supplied forwarding headers could spoof the client address.
- Where should I register this middleware relative to auth, CSRF, and route middleware?
- Register the middleware in the HTTP pipeline and confirm its effective priority alongside authentication, CSRF, and route middleware in staging. The package overview does not specify an exact ordering, so verify the resolved order in your application. Blocking early, before heavier middleware runs, is usually desirable, but validate that health checks and probes still return 200.
- Are blocked and allowed requests logged with enough context for incident review?
- Logging is identified as a key question in the technical assessment, so confirm whether block and allow decisions are recorded with enough detail for incident review. If coverage is limited, add your own logging around the middleware or capture 403 responses at the web server. Useful context includes the resolved client IP, User-Agent, request path, and the rule that matched.
- Can I disable or override the blocklist behavior per environment?
- Because the package is configuration-driven, you can publish the config and vary allowed_ips and blocklist behavior per environment. Use environment-specific configuration values and clear the config cache after changes. Validate each environment separately, especially staging versus production behind a reverse proxy.
- Is scanner-ban-bundle a replacement for a WAF, and how does it compare to other bot-blocking options?
- No, it is best treated as a lightweight edge-control layer for bot and User-Agent blocking and IP allowlisting, not as a sole security control for public traffic. It complements a WAF, network policy, and application authentication, and its advantage is being stateless and configuration-driven with no external infrastructure. If you need managed rules, rate limiting, or threat intelligence feeds, pair it with a WAF rather than replacing one.