Login Guard, Brute Force Protection and Login Alerts

Login Guard protects the login page of your Dolibarr and tells you when something unusual happens on an account.

After several wrong passwords in a row, the offending IP address is paused. Five minutes the first time, longer at each repeat offence, up to a ceiling you define. Your own addresses stay on a whitelist so you never lock yourself out.

When an account logs in from a device or a country never seen before, the account owner receives an email showing the city, the IP address, the browser and a map of the area.

The first login of each user is learned silently, so nobody gets a false alarm on the first day. A password policy enforces a minimum length, character classes and no reuse of previous passwords. Expiry with an advance notice by email can be enabled if your organisation requires it.

The active sessions screen shows who is connected right now and lets you close any session in one click.

The login journal records every attempt with its date, account, IP address, country and browser. It can be filtered, sorted and exported to CSV, and it is purged automatically after the retention period you choose, which makes it usable as evidence in a GDPR record of processing activities. An interactive world map places every login. Zoom in, click a point and see the accounts and IP addresses behind it.

Everything runs on your own server. Geolocation relies on a database stored locally, either the free DB-IP Lite in one click or MaxMind GeoLite2 with your own licence key, so no IP address and no user data ever leaves your Dolibarr. There is no API key to maintain, no subscription and no external service to trust.

Compatible with Dolibarr 16.0 to 23.x, PHP 7.4 to 8.3, MySQL, MariaDB and PostgreSQL. Tested on fresh installations of Dolibarr 16.0.5, 22.0.3 and 23.0.2. Multi-company aware, each entity only sees its own activity. French and English translations included.

Install it like any external module. Home, Setup, Modules, Deploy external module, upload the zip and enable it. Protection starts immediately with safe defaults. The more intrusive features such as password expiry and idle logout are shipped disabled.