The firewall that runs
before your PHP does.
Engineering notes, release write-ups and plain-English guides from the team behind SmartKiller — the self-hosted web firewall for WordPress, Laravel and any PHP site.
Three point oh.
The biggest SmartKiller release yet — rebuilt from the engine up, with a new console and an install that doesn't touch your code.
Introducing SmartKiller 3.0: zero-edit install, a real Security Center, and Bunker Mode
Upload one folder, run a two-minute wizard, done. Here's everything that changed — and why.
- Automatic mode protects every PHP page without editing a single file
- Fair escalation: warning → quarantine → blocklist
- Incident IDs, fake-Googlebot detection and 404-scan detection
Latest from the lab
php2shell: how to protect your PHP site today
Two critical PHP flaws are being exploited. Check, patch, mitigate and verify, step by step.
FreddyDeveloper8 minHardening your PHP server: 9 settings worth changing
Patching closes this hole. These settings limit the damage from the next one.
FreddyDeveloper6 min3.0Introducing SmartKiller 3.0
Zero-edit install, the Security Center, Bunker Mode, Incident IDs and a fairer escalation model.
FreddyDeveloper7 minInside the request pipeline: every check, in order
What SmartKiller 3.0 does to each request before your application code runs — step by step.
FreddyDeveloper6 minCloudflare + SmartKiller: verified real IPs, zero code
Why you want both layers — and how 3.0 makes the real-IP setup a single, spoof-proof toggle.
FreddyDeveloper5 minRate limiting, done fairly
Sliding windows, separate counters, and why a stricter limit for watched IPs beats a stricter limit for everyone.
FreddyDeveloper6 minUpgrading from v2.1 to 3.0 in five minutes
Keep your blocklist, trusted IPs, logs and admins. Then delete the old files and the include lines.
FreddyDeveloper4 minBunker Mode and Incident IDs: tools for the bad day
Lock the whole site down in one click without hurting SEO — and trace any block back to its cause.
FreddyDeveloper5 minFair to people. Ruthless to bots.
One mistake earns a warning, not a ban. Persistence is what gets an IP removed — and every threshold is yours to tune in Firewall Rules.
Clean visitor
No history. Full rate limit, zero friction, no CAPTCHA.
Warning
Sees a warning page and joins the Watchlist, where its rate limit is halved.
Quarantine
Blocked for 1 hour with HTTP 429 and a live countdown. Released automatically.
Blocklist
Permanently blocked until you review it. Hacking tools and scanners fast-track to quarantine.
2.1 → 3.0, at a glance
The short version. The full story is in the release post.
getRealIP()Protected in about two minutes
PHP 7.4+ with mysqli, and MySQL 5.7+ or MariaDB 10.3+. That's the whole list.
Upload
Put the smartkiller folder in your site root.
public_html/smartkillerRun the wizard
Open the installer and enter your database details.
/smartkiller/install.phpGo Automatic
Create your admin account and choose Automatic protection.
Sign in
Your Security Center is ready.
/smartkiller/dashboard.php
Let the raptor guard the door.
One-time setup. No monthly fees. Works standalone or behind Cloudflare.