Security Extension

Thank you for your purchase!

Installation

Step 1: Upload Extension Files

Upload the Security extension files to your Paymenter installation:

/var/www/paymenter/extensions/Others/Security/

Upload all Security files to extensions/Others/Security/ using SFTP or your preferred file transfer method.

Step 2: Enable Extension

Enable the extension in your Paymenter admin panel:

Admin Panel → Extensions → Others → Security → Enable

The extension runs its database migrations automatically when enabled, and again after an update.

Configuration

Extension Settings

After enabling, configure the security settings in the admin panel:

⚠️ CRITICAL: Required Integration

Successful logins and registrations are recorded automatically once the extension is enabled. To stop suspended users, blocked IPs and VPN connections before they get in, and to record failed attempts, add the blocks below to your login and registration components.

Configure Login Integration

Add this to /app/Livewire/Auth/Login.php at the top, alongside the other use statements:

use Paymenter\Extensions\Others\Security\Services\SecurityService;

Inside the submit() method, add this check just before the rate-limiter block (the RateLimiter::tooManyAttempts(...) call):

$securityService = app(\Paymenter\Extensions\Others\Security\Services\SecurityService::class);
$error = $securityService->checkLoginSecurity($this->email, request()->ip());
if ($error !== null) {
    $this->addError('email', $error);
    return;
}

A few lines below, find the block that rejects a wrong password and add one line to it:

if (!$user || !Hash::check($this->password, $user->password)) {
    $securityService->recordFailedLogin($this->email, request()->ip());   // add this line
    $this->addError('email', __('auth.failed'));

    return;
}

That one line drives three things: the entry in Login Attempts , the security webhook, and the Max login attempts counter that blocks an IP automatically. Leave it out and failed logins are never counted, so an IP is never blocked.

Configure Registration Integration

Add this to /app/Livewire/Auth/Register.php at the top with the other use statements:

use Paymenter\Extensions\Others\Security\Services\SecurityService;

In your submit() method, add the security check at the beginning (before $validatedData = $this->validate(); ). Paymenter's registration form uses separate first_name and last_name fields, so combine them for the name check:

$securityService = app(\Paymenter\Extensions\Others\Security\Services\SecurityService::class);
$error = $securityService->checkRegistrationSecurity(
    $this->email,
    request()->ip(),
    trim($this->first_name . ' ' . $this->last_name)
);
if ($error !== null) {
    $this->addError('email', $error);
    return;
}

And after creating the user (after User::create(...) ), add:

$securityService->recordSuccessfulRegistration($user->email, request()->ip(), $user->id);

After a Paymenter update

Paymenter updates overwrite app/Livewire/Auth/Login.php and Register.php , which removes the blocks above. If blocked IPs suddenly get through, or failed attempts stop appearing in the log, that is the first thing to check:

grep -c SecurityService app/Livewire/Auth/Login.php app/Livewire/Auth/Register.php

A zero for either file means the integration is gone and has to be added again. Successful logins keep working either way, because those do not depend on these files.

Webhooks

Security events can be pushed to a Discord webhook. Go to Admin Panel → Security → Security Webhooks , add your webhook URL and pick the events you want.

Use the Test action on a webhook to send a sample message and confirm the URL works.

Usage

Viewing Security Logs

Everything lives under the Security group in the admin sidebar:

• Login Attempts — every successful and failed login, with IP, user agent and reason
• Blocked IPs — currently blocked addresses and their failed-attempt counter
• Suspended Accounts — suspended users and the reason
• Security Audit Logs — every security event, the source of the webhook messages
• Security Webhooks — your webhook endpoints
• Security Whitelist — IPs and email addresses that skip all checks
• IP Reputation Cache — cached results of reputation lookups

Managing Blocked IPs

1. Go to Admin Panel → Security → Blocked IPs
2. View all currently blocked IPs
3. Unblock IPs manually if needed

Troubleshooting

Need Help?

Join our Discord Server and open a ticket for support.

© 2026 Security Extension - BuiltByOtte . All rights reserved.