django-defender

What it is and what it does

django-defender is a Django middleware that prevents brute-force login attacks by tracking failed authentication attempts in Redis rather than the database. When a user or IP address exceeds a configurable threshold of failed attempts, they are temporarily blocked from further login tries. The package logs all attempts to the database for auditing, supports reverse proxies with custom IP headers, and allows rate limiting by username, IP address, or both.

It prioritizes speed—the design goal is to add minimal latency to login requests by using Redis for real-time checks instead of database queries. The package includes Django admin pages to view blocked users and recent attempts, a management command to clean up old records, and signals for custom handling when blocks occur. Configuration covers Redis connection details, block duration, and attempt thresholds.

Use it for:

• Protect a public Django login form from credential-stuffing attacks by blocking IPs after repeated failures.
• Audit login attempts by storing them in the database while using Redis for fast real-time blocking decisions.
• Unblock users and IPs manually via the Django admin interface when legitimate users are locked out.
• Configure different block thresholds and durations for different deployment environments without code changes.
• Run scheduled cleanup jobs to prune old login attempt records and keep the database table size manageable.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Blocks brute-force login attempts in Django by tracking failed attempts via Redis cache, without requiring database queries on each login check.

Yes, with conditions. Install if you need fast, Redis-backed brute-force protection and can manage a Redis dependency. The package is production-stable and carries no known vulnerabilities, but maintenance is slow (911 days since last release). It is suitable for sites prioritizing login speed over database-backed audit trails; if you need tighter integration with Django's auth system or don't want to run Redis, consider alternatives.

Install

django-defender on PyPI

pip install django-defender

uv add django-defender

poetry add django-defender

Installing django-defender

Before you install

Low install friction with a pure Python wheel. Maintenance is aging—last release was 911 days ago and the last commit is recent, but the project shows signs of slow iteration. Requires Django 3.2+ and Redis 5.x or later.

License in practice

Licensed under Apache 2 (permissive), so you can use, modify, and distribute it freely in commercial and private projects with minimal restrictions.

Quickstart

pip install django-defender

# In settings.py, add 'defender' to INSTALLED_APPS and add FailedLoginMiddleware to MIDDLEWARE_CLASSES
# Then run: python manage.py migrate defender

Requires a running Redis instance (5.x, 6.x, or 7.x) and Django 3.2 or later; Redis connection must be configured in Django settings.

Verify before relying

• Whether the package works with Django 5.0, 5.1, 5.2 as documented (classifiers show only up to 4.1)
• Current state of the admin interface and whether all documented features are fully functional
• Performance comparison with django-axes under real-world traffic loads

Package facts

Evidence: django_defender-0.9.8-py3-none-any.whl

Keywords: django, cache, security, authentication, throttle, login

Tags

More Libraries packages