Released

Howdah 1.3.0 is released — Layer 1 (request-shape limits) plus Layer 2 (input inspection, log-only). Howdah starts in detect mode: the critical limits block, everything else only logs. Read the coverage table for exactly what has been tested on your PHP version before you switch rules to block.

Howdah

Home / Blog / Howdah 1.0

Howdah 1.0: a defensive firewall inside PHP

Howdah 1.0 is released. Howdah is an open-source, defensive web application firewall that loads into PHP itself and refuses abusive request shapes before they exhaust memory — on PHP 5.4 through 8.5, including the end-of-life branches that will never get the official fix.

What's in 1.0

  • Layer 1 complete. 0.1 shipped the critical multipart-upload limits. 1.0 adds the rest of the first layer: input-shape limits (variable count, array nesting, key length) and request-header limits, each configurable with a sensible default.
  • apt and yum repositories at pkg.howdah.org, signed, so you can apt-get install php8.1-howdah or yum install php81-howdah instead of unpacking a tarball.
  • An install picker that writes the exact install, verify and rollback commands for your OS, PHP source, version and server type.
  • aarch64 builds alongside x86_64.
  • A browser demo that runs the real core, compiled to WebAssembly, so you can see a verdict without installing anything.

Who it's for

Sysadmins who run PHP on their own servers — especially servers stuck on old PHP. If you can upgrade or patch, do that first; Howdah is for when you cannot, or until you can. It runs entirely inside your PHP: no account, no cloud service, no outbound connections.

Start in detect mode

Howdah ships in detect mode. The critical resource-exhaustion limits still block (that is the point — a detect-mode rollout is never open to a part-flood during the first hours), while everything else logs so you can watch it before you let it block. When the logs look clean, switch to block. Check the coverage table for your PHP version first.

Honest about scope

Howdah does one narrow thing: it refuses resource-exhaustion request shapes from inside PHP. It is not a general-purpose WAF, and it is not a replacement for patching. Every protection claim on this site links to the test or measurement behind it. We reproduce only the harmless structure of an attack in our tests — counts and sizes, never a working exploit — and we say plainly what we have and have not verified. Layers 2 to 4 (request inspection, runtime sink checks, post-breach containment) are the roadmap, not part of 1.0.

Get it

Head to the install picker, or read the documentation. The source, the lab and this site are all on GitHub. If you try it, we would love to hear how it went — especially on PHP versions the coverage table has not reached yet.