Connectors
Laravel
Install porro/laravel-connector for a /porro page with site health, activity and blocking, and reports to Porro.
porro/laravel-connector adds a /porro page to any Laravel 11–13 app on PHP 8.2+, like Horizon's dashboard but for the site's health. It's the base the Filament and Statamic connectors build on: on those sites, install theirs instead.
Install
composer require porro/laravel-connector
php artisan migrate
The migration adds the porro_blocklist and porro_safelist tables. That's it for the panel; to report to Porro as well, connect the site.
The /porro page
Three tabs:
- Site health: the checks below, and Porro's findings once connected.
- Activity: suspicious requests in the last 24 hours, with buttons to block or safelist each IP. See Suspicious activity.
- Blocking: where blocks are enforced, the blocklist and safelist, and what's always protected. See Blocking.
Who can open it
Locked down like Horizon. In the local environment anyone can open it. Anywhere else it returns 403 unless your app defines a viewPorro gate that allows the signed-in user; guests never get in. Define the gate in a service provider's boot():
use Illuminate\Support\Facades\Gate;
Gate::define('viewPorro', fn (User $user) => in_array($user->email, ['[email protected]']));
Changing the lists also checks a managePorroBlocklist gate when you define one. Without it, anyone who can view the page can change the lists.
- Path:
PORRO_PATHmoves it (defaultporro). - Middleware:
porro.page.middlewareinconfig/porro.php(defaultweb). - Off:
PORRO_PAGE=false.
Everything is in one Blade layout with inline styles, so there's nothing to publish or build.
Site health
Checked on the site, with no account:
| Check | How |
|---|---|
| Security advisories | composer.lock against Packagist's advisories API, the one composer audit uses. Only package names are sent. |
| PHP and Laravel support | Past, or within 90 days of, the end of security support, from endoflife.date. A copy ships with the package. |
| Updates | Newer Laravel releases on the major version you run |
| Scheduler | Whether schedule:run is running, from a heartbeat, and whether the crontab has the line. php artisan porro:cron adds it. |
| Debug, migrations, failed jobs | APP_DEBUG on in production, migrations not run, failed jobs in the last 24 hours |
| Backups and health | spatie/laravel-backup and spatie/laravel-health, if you use them |
Results are cached for five minutes, and the public data behind them for between six hours and a day.
Commands
| Command | Does |
|---|---|
porro:connect <key> |
Saves the key, sends the first report and sets up cron (--cron, --no-cron) |
porro:cron |
Adds the scheduler to the crontab, no key needed |
porro:report |
Sends a report now (--packages forces the package list) |
porro:status |
Shows what the next report contains (--json for the raw report) |
porro:block <ip> |
Blocks an IP or range (--reason, --days; --remove unblocks) |
porro:blocklist-sync |
Tidies the blocklist and writes the nginx deny file |
porro:cloudflare |
Blocks at Cloudflare's edge: status, connect, sync or disconnect |
Every setting is on Settings.