Free site health and IP blocking for Laravel, Filament and Statamic

Porro's connectors are a set of free packages that check a Laravel app from the inside and show the results on a page you can lock down like Horizon. There are versions for plain Laravel, Filament 3–5 and Statamic 5–6. They work without a Porro account.

composer require porro/laravel-connector
php artisan migrate

Visit /porro locally to see three tabs.

Site health checks:

• known security advisories in composer.lock, using the same Packagist advisories API as composer audit (only package names leave the site)
• PHP and Laravel versions past or close to the end of security support, from endoflife.date with a bundled copy for when it can't be reached
• newer Laravel releases waiting
• whether the scheduler actually runs, pending migrations, failed jobs, debug mode left on in production, and any spatie/laravel-health checks

Activity lists suspicious requests from the last 24 hours: probes for /.env, /.git and wp-login.php, failed sign-ins (from Laravel's Failed auth event), bursts of 404s and form floods. Normal page views never touch the database: suspicious requests are appended to a small buffer file and recorded in batches by the scheduler. Each IP has a detail page with its network, a hostname that's only shown when it resolves back to the same address, and badges for Tor exits, Spamhaus DROP, hosting networks and crawlers that aren't who they say they are.

Blocking lets you block or safelist an IP. Blocked IPs get a plain 403 from middleware at the front of the global stack. It works out the visitor's IP itself, trusting Cloudflare's header only on requests that come from Cloudflare's published ranges. Cloudflare, Laravel Forge's health checks, private ranges, your safelist and your own IP are refused if you try to block them.

Outside the local environment the page returns 403 unless a viewPorro gate allows the user:

Gate::define('viewPorro', fn (User $user) => in_array($user->email, [
    '[email protected]',
]));

Filament and Statamic users get the same pages inside the panel, with a dashboard widget and blocking at Cloudflare or in nginx as well as in the app:

composer require porro/filament-connector
composer require porro/statamic-connector

The connectors are built by the team behind Porro, a dashboard for agencies that look after lots of client sites. Connecting a site to Porro adds uptime, SSL, domain and server checks alongside the ones above, but everything above works without it.

Source: Porrodev/laravel-connector, filament-connector, statamic-connector.