{"categories":[{"label":"Security","url":"https://skillfed.io/packages/category/security"},{"label":"Logging","url":"https://skillfed.io/packages/category/system-logging"},{"label":"Log Analysis","url":"https://skillfed.io/packages/category/internet-log-analysis"}],"enrichment":{"capability":"django-axes tracks failed login attempts to Django sites and blocks attackers who exceed a configured attempt limit, supporting IP address, username, user agent, and combination-based tracking.","skillfed_tags":["authentication","brute-force-protection","django-plugin"],"use_cases":["Protect a public-facing Django site from credential-stuffing and password-guessing attacks by blocking repeated failed attempts from a single IP.","Log and audit login failures for compliance audits (PCI, GDPR) while masking sensitive credentials.","Implement per-user lockout policies to prevent account enumeration and targeted attacks on known usernames.","Use cache-based tracking for high-traffic sites where database writes would become a bottleneck.","Allow-list trusted IPs or user accounts to bypass rate-limiting for internal or administrative access."],"what_it_does":"django-axes is a Django plugin that monitors login attempts and implements brute-force attack prevention. It records each failed login attempt and can block further attempts from the same IP address, username, user agent, or combinations thereof once a threshold is exceeded. The package supports both database persistence and cache-based tracking, allowing operators to choose between durability and speed; it also provides cool-off periods, IP allow-listing and block-listing, and user account allow-listing.\n\nThe package integrates as middleware and authentication backend into Django's standard login flow. It can be configured to track attempts by various identifiers, mask sensitive parameters in logs for privacy compliance, and respond with HTTP 429 (Too Many Requests) by default when a lockout occurs. It supports async middleware and includes management commands for resetting lockouts.","worth_installing":"Yes. django-axes is a mature, actively maintained security plugin (1699 GitHub stars, top 5000 PyPI packages) with no known vulnerabilities, permissive licensing, and low install friction. It directly addresses a common attack vector (brute-force login) and integrates cleanly into Django's authentication layer. Install it if you operate a Django site with user authentication and want straightforward, configurable login-attempt monitoring and blocking."},"id":"django-axes","links":{"html":"https://skillfed.io/packages/django-axes","md":"https://skillfed.io/packages/django-axes.md","pypi":"https://pypi.org/project/django-axes/"},"maintenance":{"status":"active"},"meta":{"latest_release":"2026-02-11","license_spdx":null,"license_treatment":"permissive","name":"django-axes","python_support":"supports_current","summary":"Keep track of failed login attempts in Django-powered sites."},"popularity":{"monthly_downloads":4246729,"position":2352,"tier":"top_5000"},"security":{"n_vulnerabilities":0},"version":"8.3.1"}