WebGuard - Advanced login management with SSO and MFA, plus user and permissions management.

WebGuard is an advanced PHP Login and User Management System built on CodeIgniter 4. It gives you a complete, production-ready foundation — authentication, group-based permissions, REST API, OAuth/Social Login, Two-Factor Auth, Single Sign-On, multi-channel notifications, and a hook-based add-on system — so you can focus on building your product instead of starting from scratch.

Trusted by developers worldwide, WebGuard v3.0.0 is the most feature-rich release to date, with 20+ interface languages, a modern admin UI, and an extensible add-on architecture that lets you inject new functionality without ever touching core files.

Core Features

Authentication & Security

✔ Login and registration with email + password
✔ Social / OAuth login — 20+ providers (Google, Facebook, GitHub, Microsoft, LinkedIn, and more)
✔ Two-Factor Authentication (TOTP) with backup codes
✔ Single Sign-On (SSO) — broker-based identity provider with JWT token issuance
✔ Password reset and recovery via email
✔ Remember Me on login
✔ Google reCaptcha v2 and hCaptcha protection
✔ Authentication throttling — account lockout after failed attempts
✔ CSRF protection on all forms
✔ XSS protection
✔ SQL injection protection
✔ Demo mode — prevents data mutation in public demos

User Management

✔ Full CRUD user management panel
✔ Unlimited user groups / roles with fine-grained permission control
✔ Impersonate any user with full session restore
✔ User activity log
✔ Avatar — upload, Gravatar, Social Network or none
✔ Adaptive timezone, date and time per user
✔ Email and SMS verification for registration
✔ GDPR data export and account deletion

REST API

✔ Full RESTful API (JSON and XML)
✔ JWT authentication
✔ Group-based API access rules
✔ Rate limiting / throttling

Notifications

✔ Email (SMTP)
✔ SMS (Twilio / SMPP)
✔ WhatsApp (New in v3.0.0)
✔ In-app notification feed
✔ Template engine with variable substitution

Add-on / Hook System

✔ Drop-in add-ons — install by uploading a .zip, no code changes required
✔ 8 hook points: user list, user form, settings tabs, notification form, and more
✔ Declarative actions (buttons, links) or custom PHP views per hook
✔ Group-based hook visibility — control which user groups see each add-on
✔ Per-hook permission filtering
✔ Automatic SQL migration on install and update
✔ Packaged sample add-on (Task Manager) included

Developer Tools

✔ Code Maker — CRUD scaffolding generator
✔ Menu Manager — drag-and-drop sidebar editor
✔ IP Manager
✔ Multi-language interface — 20+ languages (EN, PT, ES, AR, DE, FR, IT, JA, KO, ZH, RU, PL, TR, HI, ID, and more)
✔ LTR and RTL layout support
✔ Storage gateway abstraction — local, AWS S3, MinIO
✔ Multi-template support
✔ Custom error pages (400, 403, 404, 503)
✔ Runs on PHP 8.1+

Demonstration

Demo URL: https://webguard.eduardofiorini.com/
Admin: admin@admin.com / 123456
User: user@user.com / 123456

Documentation

View Full Documentation

Server Requirements

✔ PHP 8.3 or higher
✔ CodeIgniter 4.7+
✔ MySQL or MariaDB
✔ Apache 2.4+ (mod_rewrite enabled)
✔ PHP Extensions: INTL, Mbstring, BCMath, OpenSSL, PDO, GD, Fileinfo, Tokenizer, XML, JSON, CURL

Support

Need help? Open a ticket and we’ll get back to you within 24–48 hours.

Project Updates

25 June 2026 – Version 3.0.0

 - CodeIgniter v4.7+ - Complete add-on / hook system with group-based permission control. - SSO broker-based authentication with JWT token issuance. - Impersonate user with full session restore. - 12 new interface languages (DE, FR, IT, JA, KO, ZH, RU, PL, TR, HI, ID, AR). - Custom error pages: 400, 403, 404, 503. - Module permission management per user group. - Redesigned admin UI with modern components. - JWT helper rewritten with improved token validation. - SweetAlert upgraded to v2. - Throttler filter on all authentication routes. - Demo mode prevents data mutation. - Datatable columns support hook-injected data. - Added WhatsApp notification channel. - Added Storage Gateway abstraction layer (local, AWS S3, MinIO). - Minor bug fixes and improvements. 

09 October 2025 – Version 2.1.0

 - CodeIgniter v4.6.3. - Updated all composer dependencies. - Minor bug fixes. 

28 March 2025 – Version 2.0.0

 - CodeIgniter v4.6.0. - REST API with JWT authentication. - Two-Factor Authentication (TOTP) with backup codes. - OAuth social login (Google, Facebook, GitHub, Microsoft, LinkedIn). - Code Maker tool for CRUD scaffolding. - Menu Manager with drag-and-drop. - IP Manager. - Impersonate user. - Group permissions stored as JSON rules. - Notification system with email and SMS. - CSRF protection on all forms. - Updated all composer dependencies. 

31 December 2024 – Version 1.4.0

 - CodeIgniter v4.5.6. - RTL layout support for sidebar menu and login page. - Updated all composer components. 

12 November 2023 – Version 1.3.5

 - CodeIgniter v4.4.3. - Focus2 Dark Theme (backend). - RTL support for backend layout. - Added Arabic language. - Fixed add-on permissions. - Improved PT and ES translations. - Documentation improvements. 

08 July 2023 – Version 1.3.0

 - CodeIgniter v4.3.6. - Frontend page with enable/disable toggle. - Pusher in-app notifications. - GDPR cookies, data export, and account deletion. - International telephone input. - Module system with access permissions per group. - API group-based permission rules. - HMVC support with WebGuard. 

28 June 2022 – Version 1.2.1

 - CodeIgniter v4.2.1. - Fixed responsive layout in table grids. - Fixed OAuth authentication screen on mobile. - Country and language fields on user profile. - Updated CSS/JS from Focus2 template. 

29 April 2022 – Version 1.2.0

 - Database-driven pagination for data grids. - Group permission description in users list. - Email sending test in settings. - Various fixes in notifications, email, user profile, and reCaptcha. - CodeIgniter v4.1.9. 

04 February 2022 – Version 1.1.0

 - PHP 8.x support. - CodeIgniter v4.1.8. - Documentation update. 

16 January 2022 – Version 1.0.0

 - Initial release. - Login, registration, password recovery. - User management with group permissions. - Activity log. - Profile with avatar upload.