--- id: django-defender version: "0.9.8" license: Apache 2 license_treatment: permissive maintenance: aging --- # django-defender — redis based Django app that locks out users after too many failed login attempts. License: permissive · Maintenance: aging · Downloads: 136.1K/mo ## What it is and what it does django-defender is a Django middleware that prevents brute-force login attacks by tracking failed authentication attempts in Redis rather than the database. When a user or IP address exceeds a configurable threshold of failed attempts, they are temporarily blocked from further login tries. The package logs all attempts to the database for auditing, supports reverse proxies with custom IP headers, and allows rate limiting by username, IP address, or both. It prioritizes speed—the design goal is to add minimal latency to login requests by using Redis for real-time checks instead of database queries. The package includes Django admin pages to view blocked users and recent attempts, a management command to clean up old records, and signals for custom handling when blocks occur. Configuration covers Redis connection details, block duration, and attempt thresholds. Use it for: - Protect a public Django login form from credential-stuffing attacks by blocking IPs after repeated failures. - Audit login attempts by storing them in the database while using Redis for fast real-time blocking decisions. - Unblock users and IPs manually via the Django admin interface when legitimate users are locked out. - Configure different block thresholds and durations for different deployment environments without code changes. - Run scheduled cleanup jobs to prune old login attempt records and keep the database table size manageable. ## Worth the install? AI-flagged interpretation of the facts above — verify before relying. Blocks brute-force login attempts in Django by tracking failed attempts via Redis cache, without requiring database queries on each login check. Yes, with conditions. Install if you need fast, Redis-backed brute-force protection and can manage a Redis dependency. The package is production-stable and carries no known vulnerabilities, but maintenance is slow (911 days since last release). It is suitable for sites prioritizing login speed over database-backed audit trails; if you need tighter integration with Django's auth system or don't want to run Redis, consider alternatives. ## Install pip install django-defender uv add django-defender poetry add django-defender ## Installing django-defender Before you install: Low install friction with a pure Python wheel. Maintenance is aging—last release was 911 days ago and the last commit is recent, but the project shows signs of slow iteration. Requires Django 3.2+ and Redis 5.x or later. License in practice: Licensed under Apache 2 (permissive), so you can use, modify, and distribute it freely in commercial and private projects with minimal restrictions. Quickstart: pip install django-defender # In settings.py, add 'defender' to INSTALLED_APPS and add FailedLoginMiddleware to MIDDLEWARE_CLASSES # Then run: python manage.py migrate defender Requires a running Redis instance (5.x, 6.x, or 7.x) and Django 3.2 or later; Redis connection must be configured in Django settings. Verify before relying: - Whether the package works with Django 5.0, 5.1, 5.2 as documented (classifiers show only up to 4.1) - Current state of the admin interface and whether all documented features are fully functional - Performance comparison with django-axes under real-world traffic loads ## Package facts - License: Apache 2 (permissive) - Python support: supports_current - Install friction: low - Maintenance: aging - Downloads: 136.1K/month (top 15,000 on PyPI) - Known vulnerabilities: none known ## Tags django login brute force protection, redis-based rate limiting django, failed login attempt blocking, django authentication throttling, ip and username login lockout, django security middleware, fast login attempt tracking, authentication, rate-limiting, redis [View on SkillFed](https://skillfed.io/packages/django-defender) · [View on PyPI](https://pypi.org/project/django-defender/)