Built an AI-Powered WAF for PHP/Laravel Apps in Africa — Here’s What It Catches

Originally published on Medium

A student developer from Cameroon built a security tool that explains exactly why it blocked a request. Here’s the story and how to install it in 30 seconds.

Press enter or click to view image in full size

As a PHP developer in Africa, you already know the problem: your apps get hit by automated bots, SQL injection attempts, and XSS attacks every single day — and most security tools built to stop them are either too expensive, too complex, or built by people who have never touched an African server in their life.

I built Kriosa to fix that.

What is Kriosa?

Kriosa is an AI-powered Web Application Firewall for PHP and Laravel apps. It uses a hybrid Machine Learning engine — combining Random Forest and Neural Networks — to detect and block threats before they reach your application. But the part that makes it different from every other WAF is the Explainable AI dashboard.

Most WAFs are a black box. They block a request and tell you nothing. Kriosa tells you exactly why it blocked it — which features of the request triggered the ML model, what the confidence score was, and what attack pattern it matched. As a developer, that means you are not just protected — you understand what happened.

What it catches:

SQL Injection attempts

Cross-Site Scripting (XSS)

Path Traversal attacks

Malicious bot detection

Rate limiting abuse

And 25+ other attack vectors

Install it in 30 seconds:

For Laravel:

//Step 1 — Install via Composer

composer require kriosa-ai/kriosa-php

//Step 2 — Add to your .env file

KRIOSA_API_KEY=sk_your_api_key_here

KRIOSA_TIMEOUT=5

KRIOSA_DEBUG=false

KRIOSA_BADGE=true

//Step 3 — Create config/kriosa.php

// config/kriosa.php

return [

    'api_key' => env('KRIOSA_API_KEY'),

    'timeout' => env('KRIOSA_TIMEOUT', 5),

    'debug'   => env('KRIOSA_DEBUG', false),

];

//Step 4 — Create the Middleware

// app/Http/Middleware/KriosaSecurity.php



use Closure;

use Kriosa;

use Illuminate\Http\Request;



class KriosaSecurity

{

    public function handle(Request $request, Closure $next)

    {

        $apiKey = config('kriosa.api_key');



        // Skip if no API key configured

        if (!$apiKey) {

            return $next($request);

        }



        try {

            $kriosa = new Kriosa($apiKey, [

                'timeout' => config('kriosa.timeout', 5),

                'debug'   => config('kriosa.debug', false),

            ]);



            if (!$kriosa->protect()) {

                return response('Access denied', 403);

            }



        } catch (\Exception $e) {

            // Fail open — don't block users if Kriosa is unreachable

            report($e);

        }



        return $next($request);

    }

}

//Step 5 — Register the Middleware

// app/Http/Kernel.php



protected $middleware = [

    // ... existing middleware

    \App\Http\Middleware\KriosaSecurity::class,

];



// OR apply to specific routes only:



// routes/web.php

Route::middleware(['kriosa'])->group(function () {

    Route::get('/dashboard', [DashboardController::class, 'index']);

});

Then add the middleware to your app/Http/Middleware/KriosaMiddleware.php:

For PHP

Or Download and use the SDK

//Step 1 — Install via Composer

composer require kriosa-ai/kriosa-php



//or download kriosa.php

<?php

// Add this to your index.php or front controller

require_once __DIR__ . '/kriosa.php'; // for downloaded 

require_once 'vendor/autoload.php'; // for composer install



//KTIOSA_API_KEY FROM YOUR .ENV FILE



$apiKey = getenv('KRIOSA_API_KEY') ?: 'YOUR_API_KEY_HERE';



try {

    $kriosa = new Kriosa($apiKey, [

        'timeout'     => 3,

        'debug'       => false,

        'fail_closed' => false,

        'show_badge'  => true,

    ]);



    if (!$kriosa->protect()) {

        header('X-Kriosa-Blocked: true');

        http_response_code(403);

        exit('Access Denied');

    }

} catch (Exception $e) {

    error_log('Kriosa Security Error: ' . $e->getMessage());

}



// Your application continues safely here...

That’s it. Your app is now protected by an AI layer that watches every incoming request.

Why I built this

I am a final-year computer science student at the University of Bamenda, Cameroon. I watched developers around me get their client sites hacked with no affordable way to understand what happened or prevent it from happening again. Enterprise WAFs like Cloudflare cost hundreds of dollars a month. Sucuri is built for a completely different context. Nothing existed for the PHP developer in Africa building real products for real clients on a real budget.

So I built it myself a hybrid ML engine, a 25+ attack, and an XAI dashboard that makes security understandable, not just automated.

It is free to start.

The Starter tier is free. No credit card. No enterprise contract. Just install the SDK, connect your app, and open the dashboard.

If you build PHP or Laravel apps and you have ever had a client site get hacked — or you are terrified of it happening — Kriosa is built specifically for you.

Try it today: kriosa.com

Install it: composer require kriosa-ai/kriosa-php

Full docs: kriosa.com/documentation.php

Built by a developer from Cameroon, for developers across Africa and beyond. If you have questions, drop them in the comments — I read everything.