Reference
Settings
Every environment setting and config option for the PHP connectors.
Environment settings go in the site's .env (or your host's environment variables). Filament and Statamic use the Laravel connector's, so one table covers all three.
Reporting to Porro
| Setting | Default | |
|---|---|---|
PORRO_KEY |
The site key. Set by connect. |
|
PORRO_ENABLED |
production only | true or false to force reporting on or off. See Connecting. |
PORRO_INTERVAL |
15 |
Minutes between reports (Laravel, Filament, Statamic) |
PORRO_FAILED_JOB_MESSAGES |
false |
Send the first line of failed jobs' exception messages, redacted (Laravel, Filament, Statamic) |
Activity and blocking
| Setting | Default | |
|---|---|---|
PORRO_ACTIVITY |
production only | Record suspicious activity |
PORRO_BLOCK_APP |
true |
Turn blocked IPs away with a 403 |
PORRO_PROTECT_FORGE |
true |
Keep Laravel Forge's addresses unblockable. Not on Forge? Set false. |
PORRO_PROTECT_CRAWLERS |
true |
Keep Google's and Bing's crawlers unblockable |
PORRO_ABUSEIPDB_KEY |
Check an IP's reputation on request |
Cloudflare and nginx
| Setting | Default | |
|---|---|---|
PORRO_CLOUDFLARE_TOKEN |
Block at Cloudflare's edge. See Cloudflare. | |
PORRO_CLOUDFLARE_HOST |
the site's host | Which Cloudflare zone to connect to |
PORRO_BLOCK_NGINX |
false |
Write a deny file for nginx, in production. See nginx. |
PORRO_NGINX_PATH |
storage/porro/nginx-blocklist.conf |
Where the deny file goes |
PORRO_NGINX_REAL_IP |
on behind Cloudflare | Put Cloudflare's real IP lines in the deny file. Set false if your config already sets real_ip_header. |
The /porro page (Laravel)
| Setting | Default | |
|---|---|---|
PORRO_PAGE |
on, except alongside Filament or Statamic | true or false to force it |
PORRO_PATH |
porro |
Where the page lives |
Config files
The rest goes in config/porro.php. On Laravel, Filament and Statamic it's under activity and blocklist (php artisan vendor:publish --tag=porro-config publishes it); on Craft it's a plain file returning an array.
// Laravel, Filament, Statamic: config/porro.php
'activity' => [
// When an IP is flagged: probes and failed logins per hour, 404s and form posts per 10 minutes.
'thresholds' => ['probe' => 3, 'login_failed' => 10, 'not_found' => 60, 'post_flood' => 20],
// Paths your app really serves that look like scanner paths.
'served' => ['/backup.zip'],
],
'blocklist' => [
// Never blocked or flagged, and can't be removed in the panel.
'safelist' => ['203.0.113.7', ['cidr' => '198.51.100.0/24', 'note' => 'Office']],
// Infrastructure that must always reach the site, on top of the built-in lists.
'protected' => ['192.0.2.0/24'],
],
// Craft CMS: config/porro.php
return [
'safelist' => ['203.0.113.7'],
'protected' => ['192.0.2.0/24'],
'served' => ['/backup.zip'],
'thresholds' => ['probe' => 3, 'login_failed' => 10, 'not_found' => 60, 'post_flood' => 20],
];