Web applications are the foundation of many digital services, making them a popular target for cybercriminals. Every day, attackers try to gain access to sensitive data, take over systems, or cause damage. As a managed host, we regularly see how these attacks take place and what impact they can have. Often, relatively simple techniques are used that exploit known vulnerabilities or misconfigurations. The result? Data breaches, downtime, reputational damage, and sometimes even financial loss.

In this article, we discuss the most common attack methods on web applications and provide practical tips to better protect your application, taking Laravel as an example. We also explain what you can rightfully expect from your hosting partner in terms of security. This article was originally published on the website of the Dutch Laravel Foundation.

What are common attacks?

Brute force and credential stuffing attacks
In a brute force attack, an attacker uses automated attempts to guess passwords and log in to the back-end of your web application, often with millions of username and password combinations. While brute force attacks often try various commonly used combinations in a relatively “simple” way, credential stuffing uses previously leaked login credentials to log into other systems. Because passwords are still often reused, there is unfortunately a real chance of a successful attack.

Exploits of known vulnerabilities
Cybercriminals often exploit known security flaws in software, including Laravel core. Vulnerabilities in related frameworks or modules, such as in the case of CVE-2025-54068  can, if not patched in time, lead to serious incidents, downtime, and data leaks. For these kinds of vulnerabilities, a public Proof of Concept or even a complete exploit is usually available in no time. Time is therefore an important factor here.

Abuse of misconfigurations
Errors in the configuration of the application or server can lead to unintended access to sensitive information or features. For instance, accidentally exposing debug information, incorrect file permissions, or improper settings in environment variables. Common misconfigurations in Laravel applications include forgetting to disable the APP_DEBUG mode in production, which makes error messages and stack traces visible to users. Additionally, it can happen that the .env file, which may contain sensitive configuration data such as database passwords and API keys, is accidentally accessible via the internet.

Insecure Direct Object References (IDOR) attacks
In an IDOR attack, an attacker manipulates a URL parameter, for example, to gain access to data or objects belonging to other users. This issue arises when there is no explicit authorization check before the data is displayed, allowing sensitive information to be exposed. In that case, an attacker can simply change a parameter in the URL (for instance, from /orders/12345 to /orders/12346) and thus possibly view the data of another user.

SQL injection attacks
In an SQL injection, an attacker injects malicious SQL code through input fields to manipulate the database. This can result in the reading, modification, or deletion of data without permission. For example, if an application directly incorporates search terms into a query without parameter binding, an attacker may use malicious input to ensure that all records are displayed. In the worst case, this can lead to the theft of sensitive data or the deletion of the entire database.

DDoS attacks
Distributed Denial of Service (DDoS) attacks attempt to render an application inaccessible by overwhelming it with a huge volume of traffic from a large number of IP addresses, preventing legitimate users from accessing it. DDoS attacks can be carried out at various levels. For example, an attacker may flood a network with TCP/UDP traffic to exhaust network capacity. A DDoS attack can also target the application itself. In that case, large quantities of HTTP(S) requests are often sent to exhaust the application or completely consume the available resources. In both cases, it can result in downtime and thus potentially lost revenue or reputational damage.

How can I protect myself against these attacks?

Limited access and strong authentication
Does your Laravel application have a publicly accessible back-end or login page? Then it’s good to ask yourself whether this is really necessary and who needs to be able to log in and from where. For example, it is advisable to restrict logins to specific IP addresses in your .htaccess file or firewall. Additionally, it is wise to limit the number of login attempts by applying rate limiting on endpoints or IP addresses, and temporarily blocking them in case of suspicious login attempts.

Should attackers still be able to carry out a brute force attack, the use of strong, unique passwords and the implementation of multi-factor authentication (MFA) are, of course, also crucial. Try to give users only the permissions they actually need from the outset!

Patch and vulnerability management
To prevent the exploitation of known vulnerabilities in your Laravel application, related frameworks, packages, and dependencies, it is important to keep them continuously up to date. We often see that active exploitation takes place immediately after a vulnerability is announced (or sometimes even before). It is therefore crucial to closely monitor information about vulnerabilities in the software you use and automate patching where possible. If that’s not possible, it’s advisable to have procedures in place to manually patch applications as quickly as possible. Stay informed of new CVEs and security updates, for example via mailing lists or GitHub security advisories. It’s also recommended to periodically scan applications for vulnerabilities, or even have them penetration tested.

Hardening and configuration checks
To prevent abuse of common misconfigurations, it’s useful to create a configuration checklist so you can check (or monitor) applications for misconfigurations before deploying and periodically thereafter. For example, make sure to disable debug mode in production (APP_DEBUG=false) and protect sensitive files like .env and storage folders. Also, consider applying HTTP headers such as X-Content-Type-Options, X-Frame-Options, and Content-Security-Policy to limit exploitation.

Strict input validation and authorization checks
To prevent SQL injections and IDOR attacks, it is essential to carefully validate user input and never incorporate it directly into SQL queries. Always use parameter binding to process input safely. Validate input on both the client and server sides, so manipulated input can still be blocked. Additionally, explicitly check with every request whether the user is authorized to access the requested object. To further reduce the risk of IDOR attacks, you can consider replacing internal IDs with UUIDs or hashes. This prevents attackers from gaining access to other objects by simply changing IDs in the URL.

Anti-DDoS measures
DDoS attacks are becoming increasingly easier and cheaper to conduct, and at the same time, they are becoming more complex and larger in scale. Therefore, it is important to check whether your hosting provider has measures in place to detect and mitigate DDoS attacks. As an additional layer, you can use a Web Application Firewall (WAF) or a specialized Anti-DDoS service like Cloudflare. This allows you to filter or rate-limit traffic so your application remains accessible to legitimate visitors. Also, ensure that your infrastructure is scalable, for instance through load balancing or autoscaling, so your application can handle peak loads. A professional managed hosting provider can advise you on this.

Our role as Managed Host

As a managed host, we are responsible for a secure and stable infrastructure on which your application runs. This means that our servers, network equipment, and underlying software are always up to date and correctly configured to prevent unauthorized access. To achieve this, we have set up an extensive patch and vulnerability management process and, for example, use strict hardening standards based on the CIS benchmarks.

In addition, your environment is equipped with 24/7 monitoring of both system capacity and security, where our engineers intervene day and night when necessary. Through our extensive XDR/SIEM platform, we monitor environments for common attacks and automatically block millions of attack attempts each day. However, if recovery is necessary, you can rely on our backup services. To provide our clients with the assurance they need, all the measures we take are periodically assessed by an external auditor as part of our ISO 27001 and NEN 7510 certifications and SOC 2 and ISAE 3402 Assurance reports.

Dutch Laravel Foundation

Shock Media is a sponsoring partner of the Dutch Laravel Foundation. This industry association focuses on organizations that use Laravel to build their own applications or develop Laravel applications for their clients. With more than 30 members, the association has a large following, and a wealth of knowledge and experience is shared among members. As a managed hosting provider managing a large number of Laravel applications, Shock Media has a strong partnership with the Dutch Laravel Foundation. Want to learn more about the Dutch Laravel Foundation? Feel free to contact us or reach out directly to the organization of the Dutch Laravel Foundation.

Learn more?
Want to know more about cybersecurity for web apps? Contact our technical experts!