Troubleshooting

I'm locked out of the Control Panel

If brute-force protection has locked your IP, the simplest fix is to wait for lockoutDuration (default 300 seconds) to expire, then log in again.

If you need immediate access, temporarily raise the limits or disable IP restriction in config/garrison.php and clear caches:

// config/garrison.php
'maxLoginAttempts' => 50,
'enableIpRestriction' => false,

php craft clear-caches/all

If geo-blocking or an IP allowlist locked you out, edit blockedCountries / geoBlockMode or enableIpRestriction in your config and redeploy. Config-file settings always take precedence over Control Panel settings, so a config change is the most reliable way back in.

A scan reports a finding I believe is a false positive

Some findings depend on your hosting environment. A reverse proxy may terminate TLS so the HTTPS check sees plain HTTP, or a platform may manage file permissions outside your control. Review each finding's detail and severity before acting.

If a check doesn't apply to your setup, scope the scanner to only the checks you care about with enabledChecks (an array of check handles; null runs them all):

'enabledChecks' => [
    'https',
    'securityKey',
    'craftUpdates',
    // ...only the checks you want
],

Scheduled scans aren't running

Scheduled scans are dispatched to Craft's queue. If they never run, the queue probably isn't being processed. In production, run a dedicated queue worker rather than relying on web requests:

# As a long-running daemon (e.g. via systemd or supervisor)
php craft queue/listen

# Or trigger from cron every minute
* * * * * php /path/to/craft queue/run

Also confirm scanSchedule is not null and that scanScheduleHour matches the timezone your server runs in.

Notifications aren't being delivered

• Confirm enableNotifications is true and that the relevant notifyOn* flag for the event is enabled.
• For email, verify Craft's own email settings work — send a test from Settings → Email. Garrison uses Craft's mailer.
• For Slack/Discord/webhooks, re-copy the webhook URL and make sure it's reachable from your server (outbound HTTPS not blocked by a firewall).
• If you reference a URL with $SLACK_WEBHOOK_URL, confirm the matching variable exists in .env — a missing env var resolves to an empty string and silently sends nowhere.

File integrity alerts after every deploy

Changing monitored files (including vendor/) on deploy will trip integrity alerts. Re-establish the baseline as the final step of your deploy, or narrow monitoredPaths to the files that should never change between deploys (such as .env and web/index.php).

The risk score seems stuck or stale

The score reflects the most recent completed scan. Run a fresh scan from the Control Panel or via php craft garrison/scan/run, then check php craft garrison/scan/status to confirm it finished. If a scan appears stuck, verify the queue is processing.

Config changes aren't taking effect

After editing config/garrison.php, clear caches with php craft clear-caches/all. Remember that values set in the config file override the same settings in the Control Panel, and that environment-specific keys ('*', 'dev', 'production') are merged in that order.

Getting Help

If you're still stuck, please open an issue on GitHub with your Craft and PHP versions, your Garrison edition, and the relevant scan output or error message.