A plugin-layer web application firewall for Tiger — CrowdSec malicious-IP blocking, captcha gating, rate-limiting, and login protection, all at the PHP layer (no root, no daemon). Built for shared hosting.
Free, first-party, BSD-licensed. One integrated shield instead of a stack of plugins. The full design + feature scope is in FEATURES.md; notable changes are in CHANGELOG.md.
Early beta. Built and shipping: the fail-open front-controller gate (ships in learn mode), login protection (per-IP + per-account, off Tiger's login audit log), general rate limiting (APCu), CrowdSec malicious-IP blocking (built-in CAPI client — no agent, no SDK — cached locally and enforced as a pure lookup), captcha gating (an interstitial + signed clearance cookie instead of a flat block, via reCAPTCHA), the admin Security screen, and the event log. Now built: the request WAF (curated ruleset, log-only default) and the dashboard widget. See FEATURES.md §15 for the phasing.
It's a Tiger module — it installs as application/modules/tigershield/. Drop it into a Tiger app's
modules dir (dev), run vendor/bin/tiger migrate, and it self-registers (module scan). The Security
screen appears under admin Settings.
BSD 3-Clause © 2026 WebTigers. Use, modify, and redistribute freely; the Tiger / TigerShield / WebTigers trademarks are reserved — see TRADEMARKS.md.