Comprehensive security for Craft CMS.

Garrison is a comprehensive security suite for Craft CMS 5. It combines a vulnerability scanner with 14 checks and a 0–100 risk score, active request-level protection (login brute-force defense, rate limiting, IP rules, a WAF, and geo-blocking), audit logging, file integrity monitoring, and multi-channel notifications.

Garrison requires Craft CMS 5.0 or later and PHP 8.2 or later.

Yes. The Free edition includes the full 14-check security scanner, the 0–100 risk score, login brute-force protection, audit logging with 30-day retention, console commands, and a dashboard widget. Pro ($99) unlocks active protection, notifications, advanced analytics, and 365-day retention.

Free is the scanner plus login protection and audit logging. Pro adds IP allowlist/blocklist, rate limiting, file integrity monitoring, multi-channel notifications, a REST API, a WAF with request filtering, geo-blocking, dashboard analytics, auto-remediation suggestions, and 365-day retention.

The scanner runs 14 checks across your configuration, HTTP headers, file permissions, encryption, and updates, then produces a 0–100 risk score. Each finding is rated info, low, medium, high, or critical, with a description and guidance on how to fix it. You can run it on demand from the Control Panel, on a schedule, or from the command line.

Yes. Set scanSchedule in config/garrison.php to hourly, daily, weekly, or monthly for automatic scans. For CI and deploy pipelines, run php craft garrison/scan/run, which returns a non-zero exit code when high-severity findings are present so you can fail a build on a regression.

Brute-force protection can temporarily lock an IP after too many failed logins, but it clears automatically after the lockout duration. If you ever need immediate access, you can raise the limits or disable IP restriction in config/garrison.php, since config-file settings always override the Control Panel. See the Troubleshooting guide for details.

Scans run on demand or via the queue, not on every page load, so they do not affect front-end performance. Active protection runs lightweight checks at the request level, and data pruning keeps the plugin tables lean automatically.

Beacon (Pro) sends alerts via email, Slack, Discord, and generic webhooks. You choose which events trigger a notification: scan failures, detected threats, and login lockouts. Email uses Craft’s own mailer configuration.

Retention follows your edition by default: 30 days on Free and 365 days on Pro. You can override it with the auditLogRetentionDays config setting, and tune pruning of blocked requests and login attempts separately.

Install with Composer using composer require justinholtweb/craft-garrison, then run php craft plugin/install garrison or install it from Settings → Plugins in the Control Panel. Full instructions are in the Installation guide.

Open an issue on the GitHub repository with your Craft and PHP versions, your Garrison edition, and any relevant scan output or error message.