Build 1 publisher2 min readPublished September 21, 2026 at 12:14 AM PDT

Every request that clears the edge still costs a PHP worker

A dev.to layering guide for self-hosted Laravel admins runs from ufw defaults through ModSecurity to a five-per-minute login limiter. Both fail2ban and that limiter depend on resolving the real client IP.

The Engineer · Build desk

Illustration accompanying Every request that clears the edge still costs a PHP worker

What happened

A dev.to guide for self-hosted Laravel admins stacks five controls: host firewall, reverse proxy with TLS and headers, a WAF ahead of PHP, fail2ban, and named Laravel rate limiters.
Its baseline ufw policy denies all incoming traffic, allows outgoing, and reopens only OpenSSH, 80/tcp and 443/tcp before the firewall is enabled.
MySQL, Redis, Elasticsearch, phpMyAdmin and queue dashboards stay off public ports, bound to localhost or a private network, with cloud security groups matching the host rules.
At the app layer the guide defines a named limiter capped at five per minute keyed on the request IP, attached to the login POST route as throttle:login.
fail2ban reads nginx or Caddy logs for repeated POST /login failures and contact endpoint floods and turns them into firewall drops.

Compiled by The EngineerSomething wrong?How this is made

Why it matters

constraint Five per minute works out to 300 attempts an hour per address, and a distributed client runs that limit from every address in its pool.
exposure An origin still reachable on app ports makes the managed CDN rules optional for the attacker, leaving the host firewall and the app limiters as the only controls in the path.
cost Running OWASP CRS in blocking mode costs tuning time against a rich CMS editor. The guide budgets for DetectionOnly first and narrow whitelists for uploads and Livewire endpoints.
decision Adopting a CDN forces a rewrite of the jail filters and the proxy trust config, or the bans land on the CDN edge instead of the offender.

A request that gets past the edge still occupies a PHP-FPM worker before the login controller can reject it. The dev.to guide states it as "Laravel still pays for every request that reaches PHP" ^[2]. The post does not measure that cost in workers or milliseconds, so read it as a design argument.

Both the app limiter and fail2ban depend on one value: the client address. Laravel's `TrustProxies` has to accept `X-Forwarded-For` and `X-Forwarded-Proto` from your proxy only, and the guide warns that wrong trust settings break HTTPS detection and rate-limit IP keys ^[6]. A limiter keyed on `$request->ip()` can only be as accurate as that header chain. fail2ban has the same dependency from the other end, because once a CDN is in front, the jail filters need to ban the real client address and not the CDN edge ^[12].

`RateLimiter::for('login', ...)` with `Limit::perMinute(5)->by($request->ip())`, attached to the login POST as `throttle:login` ^[13], allows 300 attempts an hour from one address ^[1]. Point a thousand-address proxy pool at the same rule and it permits 300,000 an hour ^[2]. The post also wants stricter limits on password reset and 2FA challenge routes, because "Attackers often pivot there after login is locked" ^[14].

For a small VPS with one CMS the guide calls a CDN WAF plus host firewall often enough; air-gapped hosts get ModSecurity on the proxy; high-traffic APIs combine an edge WAF with precise Laravel throttles "so good API keys are not painted like scrapers" ^[10]. The first of those holds only if the origin accepts traffic on app ports from the CDN alone, since an open origin IP lets attackers bypass the WAF entirely ^[9]. If you cannot enforce that, the host firewall and the named limiters are the only throttling left.

The ufw sequence ends with a reminder to confirm SSH still works before you close the laptop ^[18]. Someone has evidently done it the other way. The post discloses that its authors build LaraDashboard, an open-source Laravel admin and CMS, and says the patterns apply to any Laravel app you own ^[15].

What to watch

Whether the promised public API limiter guidance arrives; the published text stops mid-sentence at "Public APIs need".
Whether LaraDashboard ships the named login, reset and 2FA limiters as route defaults rather than as documentation.
Whether CRS whitelist recipes for Livewire admin endpoints get published, since that tuning is the cost of blocking mode.

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[6]
The guide says to set TrustProxies so X-Forwarded-For and X-Forwarded-Proto come from your proxy only, and that wrong trust settings break HTTPS detection and rate-limit IP keys.
ReportedSupported2 sources— sign in to open View cited source
[12]
The guide says to whitelist office and VPN egress, and that after adopting a CDN you must ban the real client IP and not the CDN edge, which requires correct forwarded headers in both the proxy and the jail filters.
ReportedSupported2 sources— sign in to open View cited source
[19]
The published text of the post stops mid-sentence at "Public APIs need".
ReportedSupported2 sources— sign in to open View cited source
[1]
A dev.to post titled "Layered Abuse Control for Self-Hosted Laravel Admins" recommends layered controls: block what should never reach the box with a host firewall, terminate TLS and add headers at the reverse proxy, filter hostile shapes at a WAF before PHP runs, ban repeat offenders with fail2ban, and cap what the app accepts per IP and per user with Laravel RateLimiter.
ReportedSupportedView cited source
[2]
"Laravel still pays for every request that reaches PHP."
ReportedSupportedSource: dev.to guide, Layered Abuse Control for Self-Hosted Laravel AdminsView cited source
[4]
The guide's ufw baseline is: default deny incoming, default allow outgoing, allow OpenSSH, allow 80/tcp, allow 443/tcp, then enable the firewall and check status verbose.
ReportedSupportedView cited source
[5]
The guide says not to expose MySQL, Redis, Elasticsearch, phpMyAdmin or queue dashboards on public ports, to bind them to localhost or a private network, and to make cloud security groups match the host rules.
ReportedSupportedView cited source
[8]
The guide says ModSecurity plus OWASP CRS works on nginx/Apache, to run DetectionOnly first, to whitelist narrow paths that break such as uploads and some Livewire endpoints, and that paranoia mode will fight a rich CMS editor if you skip tuning.
ReportedSupportedView cited source
[9]
The guide says a CDN WAF gives managed rules without maintaining CRS yourself, that the origin must be locked so only the CDN can reach app ports, and that if the origin IP is public and open, attackers bypass the WAF entirely.
ReportedSupportedView cited source
[10]
The guide's sizing advice: small VPS with one CMS, CDN WAF plus host firewall is often enough; air-gapped hosts, ModSecurity on the proxy; high traffic APIs, combine edge WAF with precise Laravel throttles "so good API keys are not painted like scrapers".
ReportedSupportedView cited source
[11]
The guide says fail2ban watches logs and turns abuse into firewall drops, recommends enabling the sshd jail with key-only SSH, and filtering nginx/Caddy logs for repeated POST /login failures or contact endpoint floods.
ReportedSupportedView cited source
[13]
The guide defines a named limiter RateLimiter::for('login', function (Request $request) { return Limit::perMinute(5)->by($request->ip()); }); and attaches throttle:login on the login POST.
ReportedSupportedView cited source
[14]
"Attackers often pivot there after login is locked."
ReportedSupportedSource: dev.to guide, on password reset and 2FA challenge routesView cited source
[15]
The post discloses that its authors build LaraDashboard, an open-source Laravel admin and CMS, and says the patterns apply to any Laravel app you own.
ReportedSupportedView cited source
[18]
The guide says to confirm SSH still works before you close the laptop, and to prefer allowlisting SSH from stable admin egress where possible.
ReportedSupportedView cited source
[d1]
A limiter of five per minute keyed on the request IP allows 300 login attempts an hour from a single address.
DerivedSupported1 source— sign in to open
[d2]
The same five-per-minute per-IP rule permits 300,000 attempts an hour across a pool of 1,000 addresses (illustrative).
DerivedSupported1 source— sign in to open

Sources

Publishers with included, body-backed reporting in this cluster.

dev.to
1 article · September 20, 2026
Layered Abuse Control for Self-Hosted Laravel Admins

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

The sequence is copy-paste: ufw default deny incoming with OpenSSH, 80 and 443 open; nginx or Caddy terminating TLS; ModSecurity with the OWASP Core Rule Set in DetectionOnly before it blocks anything; a fail2ban sshd jail with key-only SSH; then a named Laravel limiter attached to the login POST. Two settings carry the rest of the stack. TrustProxies has to accept X-Forwarded-For from your proxy and nowhere else, and fail2ban's filters have to read the same header, or the ban lands on a Cloudflare edge address instead of the bot. The limiter example is Limit::perMinute(5)->by($request->ip()), which is 300 login attempts an hour from a single address and 300,000 from a thousand of them. Keying on the submitted username as well as the address is left to you. Our copy of the post breaks off mid-word in the closing disclosure.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence36

0100

One vendor-written guide

Everything here comes from a single dev.to post by the team behind LaraDashboard. The instructions are specific enough to check against the tools' own documentation (ufw default-deny, ModSecurity in DetectionOnly, a named Laravel limiter), and they track common hardening practice. Nobody else tests the central promise that this stack closes the abuse gate; no independent benchmark or incident write-up backs it, and no other publisher has covered it. The weakest internal seam is the login example, since per-IP keying is what a distributed stuffing run is built to defeat.

AdoptionInsufficient

No one on record running it

Nobody in the post says they run the five layers in production, and LaraDashboard's own usage is not quantified, so there is no adoption to measure.

Hype gap+12

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Entities

build
Rule 200001 turns a buffered prompt into fields the OWASP Core Rule Set can match
1 publisher
build
Once the question needs a cube, you own the parser
1 publisher
build
Laravel's session cookie is why your HTML never gets cached at the edge
1 publisher
build
HTTP/2 gives a lossy mobile link one TCP connection to stall instead of six
1 publisher

What happened

Why it matters

What to watch

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Claim ledger

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Perspective Coverage

Reality

Related stories

Sources