Garrison for Craft CMS
Usage
Garrison is organized into four parts: the Scanner (vulnerability checks and risk score), Shield (active request-level protection), Sentinel (audit logging and file integrity), and Beacon (notifications). This guide covers day-to-day use of each.
Running a Security Scan
Open Garrison in the Control Panel sidebar and click Run Scan. The scanner runs 14 checks across your site's configuration, headers, permissions, encryption, and updates, then produces a 0–100 risk score — higher is safer.
Each finding is assigned a severity of info, low, medium, high, or critical, with a description of the issue and guidance on how to resolve it. Re-run the scan after making changes to confirm the finding clears.
What the scanner checks
| Check | What it looks for |
|---|---|
| CMS Config | Insecure general.php settings (dev mode, allowAdminChanges, etc.) |
| Craft Updates | Outdated Craft or plugin versions with known advisories |
| CSRF Protection | Whether CSRF protection is enabled |
| Default Admin | Admin accounts using predictable usernames like admin |
| File Permissions | Over-permissive files and directories |
| GraphQL Introspection | Publicly exposed GraphQL schema introspection |
| HTTPS | Whether HTTPS is enforced |
| PHP Version | Unsupported or end-of-life PHP versions |
| Powered-By Header | Server fingerprinting via the X-Powered-By header |
| Secure Cookies | Missing Secure / HttpOnly cookie flags |
| Security Key | A weak, missing, or committed security key |
| Session Duration | Overly long authenticated session lifetimes |
| SVG Sanitization | Whether uploaded SVGs are sanitized |
| Webroot Exposure | Sensitive files reachable from the public web root |
Scheduled Scans
Garrison can run scans automatically on a schedule. Set scanSchedule in config/garrison.php to 'hourly', 'daily', 'weekly', or 'monthly' (or null to disable), and use scanScheduleHour to choose the hour of day:
'scanSchedule' => 'daily',
'scanScheduleHour' => 3, // 3amScheduled scans rely on Craft's queue. Make sure a queue runner is configured in production (for example, php craft queue/listen via a daemon, or a cron job hitting queue/run).
Console Commands
Garrison exposes scan commands for use in CI pipelines, cron jobs, or deploy scripts:
# Run a full security scan
php craft garrison/scan/run
# Print the status and score of the most recent scan
php craft garrison/scan/statusgarrison/scan/run returns a non-zero exit code when high-severity findings are present, so you can fail a build or deploy on a regression.
Active Protection (Shield)
Shield enforces protection at the request level. Login brute-force protection is available in every edition; the rest unlock by edition.
| Feature | Edition | Config |
|---|---|---|
| Login brute-force lockout | Free | maxLoginAttempts, lockoutDuration, loginAttemptWindow |
| Rate limiting | Pro | enableRateLimiting, rateLimit, rateLimitWindow |
| IP allowlist / blocklist | Pro | enableIpRestriction |
| WAF (request filtering) | Pro | enableWaf, wafRules |
| Geo-blocking | Pro | enableGeoBlocking, blockedCountries, geoBlockMode |
When a request is blocked, Garrison records the reason (failed login, rate limit, WAF rule, geo rule, or manual block) so you can review it in the Control Panel.
Audit Logging & File Integrity (Sentinel)
Audit logging is on by default (enableAuditLog) and records security-relevant events — logins, lockouts, setting changes, and threats. Retention follows your edition (30 days on Free, 365 days on Pro) unless you override it with auditLogRetentionDays.
File integrity monitoring (Pro) fingerprints sensitive paths and alerts you when they change unexpectedly. Set a baseline after a known-good deploy, then let Garrison compare against it:
'enableFileIntegrity' => true,
'monitoredPaths' => [
'vendor/craftcms/cms/src/',
'config/',
'.env',
'web/index.php',
],Notifications (Beacon)
Beacon (Pro) sends alerts through email, Slack, Discord, and generic webhooks. Enable notifications and choose which events trigger them:
'enableNotifications' => true,
'notifyOnScanFailure' => true,
'notifyOnThreatDetected' => true,
'notifyOnLoginLockout' => false,
'emailRecipients' => ['[email protected]'],
'slackWebhookUrl' => '$SLACK_WEBHOOK_URL',
'discordWebhookUrl' => '',
'webhookUrl' => '',Store webhook URLs in your .env and reference them with the $VAR syntax so secrets stay out of version control.
Dashboard Widgets
Garrison ships two widgets for the Craft dashboard:
- Security Score — your current risk score at a glance, with a link to the latest scan.
- Recent Threats — the most recent blocked requests and detected threats.
Add them from the Craft dashboard via + New Widget.
Data Pruning
Garrison automatically prunes old records to keep tables lean. Tune the windows with pruneBlockedRequestsDays (default 90) and pruneLoginAttemptsDays (default 30).
