django-axes

What it is and what it does

django-axes is a Django plugin that monitors login attempts and implements brute-force attack prevention. It records each failed login attempt and can block further attempts from the same IP address, username, user agent, or combinations thereof once a threshold is exceeded. The package supports both database persistence and cache-based tracking, allowing operators to choose between durability and speed; it also provides cool-off periods, IP allow-listing and block-listing, and user account allow-listing.

The package integrates as middleware and authentication backend into Django's standard login flow. It can be configured to track attempts by various identifiers, mask sensitive parameters in logs for privacy compliance, and respond with HTTP 429 (Too Many Requests) by default when a lockout occurs. It supports async middleware and includes management commands for resetting lockouts.

Use it for:

• Protect a public-facing Django site from credential-stuffing and password-guessing attacks by blocking repeated failed attempts from a single IP.
• Log and audit login failures for compliance audits (PCI, GDPR) while masking sensitive credentials.
• Implement per-user lockout policies to prevent account enumeration and targeted attacks on known usernames.
• Use cache-based tracking for high-traffic sites where database writes would become a bottleneck.
• Allow-list trusted IPs or user accounts to bypass rate-limiting for internal or administrative access.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

django-axes tracks failed login attempts to Django sites and blocks attackers who exceed a configured attempt limit, supporting IP address, username, user agent, and combination-based tracking.

Yes. django-axes is a mature, actively maintained security plugin (1699 GitHub stars, top 5000 PyPI packages) with no known vulnerabilities, permissive licensing, and low install friction. It directly addresses a common attack vector (brute-force login) and integrates cleanly into Django's authentication layer. Install it if you operate a Django site with user authentication and want straightforward, configurable login-attempt monitoring and blocking.

Install

django-axes on PyPI

pip install django-axes

uv add django-axes

poetry add django-axes

Installing django-axes

Before you install

Low install friction with only django and asgiref as runtime dependencies. Actively maintained with recent releases; last commit 2026-08-14 and version 8.3.1 released 2026-02-11. Supports current Python versions (3.10–3.14) and recent Django releases (4.2, 5.2, 6.0).

License in practice

MIT license (permissive) allows commercial and private use with minimal restrictions—you may use, modify, and distribute the package freely provided you include the license notice.

Quickstart

pip install django-axes

# In Django settings.py, add to INSTALLED_APPS:
# 'axes'

# In urls.py, include axes URLs:
from django.urls import path, include
urlpatterns = [
    path('admin/login/', include('axes.urls')),
]

# Login attempts are now tracked and blocked after configured limit

Requires Django project setup; django-ipware is optional but recommended for robust IP detection behind proxies.

Verify before relying

• Whether cache-based attempt tracking (mentioned as alternative to database) performs better for high-traffic sites.
• Specific cooloff period defaults and whether they are configurable per-attempt type.
• Performance impact of tracking by combination of IP, username, and user agent simultaneously.

Package facts

Evidence: django_axes-8.3.1-py3-none-any.whl

Keywords: authentication, django, pci, security

Tags

More Security packages