django-defender
redis based Django app that locks out users after too many failed login attempts.
Decision gist · record as of 2026-08-14
Yes, with conditions. Install if you need fast, Redis-backed brute-force protection and can manage a Redis dependency. The package is production-stable and carries no known vulnerabilities, but maintenance is slow (911 days since last release). It is suitable for sites prioritizing login speed over database-backed audit trails; if you need tighter integration with Django's auth system or don't want to run Redis, consider alternatives.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires a running Redis instance (5.x, 6.x, or 7.x) and Django 3.2 or later; Redis connection must be configured in Django settings.
- Low install friction with a pure Python wheel.
- Maintenance is aging—last release was 911 days ago and the last commit is recent, but the project shows signs of slow iteration.
License · maintenance · safety
Apache 2 (permissive) — Licensed under Apache 2 (permissive), so you can use, modify, and distribute it freely in commercial and private projects with minimal restrictions.
last release 2024-02-15 (911 days) · last repo commit 2026-02-01 · 1,082 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 136,140 downloads/mo, #11,404 on PyPI
Alternatives
Verify before relying
pip install django-defender
# In settings.py, add 'defender' to INSTALLED_APPS and add FailedLoginMiddleware to MIDDLEWARE_CLASSES
# Then run: python manage.py migrate defender- Whether the package works with Django 5.0, 5.1, 5.2 as documented (classifiers show only up to 4.1)
- Current state of the admin interface and whether all documented features are fully functional
- Performance comparison with django-axes under real-world traffic loads
What it is and what it does
django-defender is a Django middleware that prevents brute-force login attacks by tracking failed authentication attempts in Redis rather than the database. When a user or IP address exceeds a configurable threshold of failed attempts, they are temporarily blocked from further login tries. The package logs all attempts to the database for auditing, supports reverse proxies with custom IP headers, and allows rate limiting by username, IP address, or both.
It prioritizes speed—the design goal is to add minimal latency to login requests by using Redis for real-time checks instead of database queries. The package includes Django admin pages to view blocked users and recent attempts, a management command to clean up old records, and signals for custom handling when blocks occur. Configuration covers Redis connection details, block duration, and attempt thresholds.
Use it for
- Protect a public Django login form from credential-stuffing attacks by blocking IPs after repeated failures.
- Audit login attempts by storing them in the database while using Redis for fast real-time blocking decisions.
- Unblock users and IPs manually via the Django admin interface when legitimate users are locked out.
- Configure different block thresholds and durations for different deployment environments without code changes.
- Run scheduled cleanup jobs to prune old login attempt records and keep the database table size manageable.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, with conditions.
Install if you need fast, Redis-backed brute-force protection and can manage a Redis dependency. The package is production-stable and carries no known vulnerabilities, but maintenance is slow (911 days since last release). It is suitable for sites prioritizing login speed over database-backed audit trails; if you need tighter integration with Django's auth system or don't want to run Redis, consider alternatives.
Install
django-defender on PyPI
Before you install
Low install friction with a pure Python wheel. Maintenance is aging—last release was 911 days ago and the last commit is recent, but the project shows signs of slow iteration. Requires Django 3.2+ and Redis 5.x or later.
Requires a running Redis instance (5.x, 6.x, or 7.x) and Django 3.2 or later; Redis connection must be configured in Django settings.
License in practice
Licensed under Apache 2 (permissive), so you can use, modify, and distribute it freely in commercial and private projects with minimal restrictions.
Quickstart
pip install django-defender
# In settings.py, add 'defender' to INSTALLED_APPS and add FailedLoginMiddleware to MIDDLEWARE_CLASSES
# Then run: python manage.py migrate defenderVerify before relying
- Whether the package works with Django 5.0, 5.1, 5.2 as documented (classifiers show only up to 4.1)
- Current state of the admin interface and whether all documented features are fully functional
- Performance comparison with django-axes under real-world traffic loads
Package facts
| License | Apache 2 permissive |
| Python support | Supports the current Python release ~=3.7 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 2 packagesDjangoredis |
| Maintenance | Aging 911 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 136,140 / month, #11,404 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 5 - Production/StableFramework :: DjangoFramework :: Django :: 3.2Framework :: Django :: 4.0Framework :: Django :: 4.1Intended Audience :: DevelopersLicense :: OSI Approved :: Apache Software LicenseOperating System :: OS IndependentProgramming Language :: PythonProgramming Language :: Python :: 3Programming Language :: Python :: 3 :: OnlyProgramming Language :: Python :: 3.10Programming Language :: Python :: 3.7Programming Language :: Python :: 3.8Programming Language :: Python :: 3.9Programming Language :: Python :: Implementation :: CPythonProgramming Language :: Python :: Implementation :: PyPyTopic :: Internet :: WWW/HTTP :: Dynamic ContentTopic :: SecurityTopic :: Software Development :: LibrariesTopic :: Software Development :: Libraries :: Python Modules |
Evidence: django_defender-0.9.8-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “django login brute force protection”
- django-defenderBlocks brute-force login attempts in Django by tracking failed…
- django-axesdjango-axes tracks failed login attempts to Django sites and blocks…
- django-allauthProvides integrated local and social authentication for Django…
Give your agent the search over MCP, or paste the wish link into any chat.
More Libraries packages
urllib3 is an HTTP client library that provides thread-safe connection pooling, SSL/TLS verification, multipart file uploads, request retries, compression support, and proxy handling for Python applications.
Requests is a Python HTTP library that simplifies sending HTTP/1.1 requests with automatic handling of headers, authentication, cookies, and response parsing.
Pluggy provides a plugin system that lets you define hook specifications and register implementations to be called in sequence, enabling extensible Python applications without tight coupling.
Install it if you're building an extensible application or framework.
Provides parsing, arithmetic, and recurrence rule computation for dates and times, with timezone support and iCalendar RFC compliance.
Install it if you need to parse flexible date strings, compute relative dates, handle timezones, or work with recurrence rules—it's the de facto choice for these tasks.
Six provides utility functions to write Python code that runs on both Python 2.7 and Python 3.3+, smoothing over language differences between the two versions.
pytest is a testing framework that lets you write test functions using plain assert statements and automatically discovers and runs them, with detailed failure reporting.
See also django-axes · django-allauth · django-ratelimit · django-redis · django-ebhealthcheck · django-revproxy · django-session-timeout · django-rq · django-pgmigrate · django-loginas