diff --git a/www/Makefile b/www/Makefile
--- a/www/Makefile
+++ b/www/Makefile
@@ -1672,6 +1672,7 @@
     SUBDIR += py-flask-moment
     SUBDIR += py-flask-mongoengine
     SUBDIR += py-flask-oauthlib
+    SUBDIR += py-flask-paranoid
     SUBDIR += py-flask-peewee
     SUBDIR += py-flask-principal
     SUBDIR += py-flask-restful
diff --git a/www/py-flask-paranoid/Makefile b/www/py-flask-paranoid/Makefile
new file mode 100644
--- /dev/null
+++ b/www/py-flask-paranoid/Makefile
@@ -0,0 +1,67 @@
+PORTNAME=	Flask-Paranoid
+DISTVERSIONPREFIX=	v
+DISTVERSION=	0.3.0
+CATEGORIES=	www python security
+PKGNAMEPREFIX=	${PYTHON_PKGNAMEPREFIX}
+
+MAINTAINER=	agh@riseup.net
+COMMENT=	Flask extension for simple user session protection
+WWW=		https://pypi.org/project/Flask-Paranoid/
+
+LICENSE=	MIT
+LICENSE_FILE=	${WRKSRC}/LICENSE
+
+BUILD_DEPENDS=	${PYTHON_PKGNAMEPREFIX}setuptools>0:devel/py-setuptools@${PY_FLAVOR} \
+		${PYTHON_PKGNAMEPREFIX}sphinx>0:textproc/py-sphinx@${PY_FLAVOR} \
+		${PYTHON_PKGNAMEPREFIX}wheel>0:devel/py-wheel@${PY_FLAVOR}
+RUN_DEPENDS=	${PYTHON_PKGNAMEPREFIX}flask>0:www/py-flask@${PY_FLAVOR} \
+		${PYTHON_PKGNAMEPREFIX}wheel>0:devel/py-wheel@${PY_FLAVOR}
+TEST_DEPENDS=	${PYTHON_PKGNAMEPREFIX}pyproject-flake8>0:devel/py-pyproject-flake8@${PY_FLAVOR} \
+		${PYTHON_PKGNAMEPREFIX}pytest-cov>0:devel/py-pytest-cov@${PY_FLAVOR} \
+		${PYTHON_PKGNAMEPREFIX}pytest>0:devel/py-pytest@${PY_FLAVOR} \
+		${PYTHON_PKGNAMEPREFIX}sphinx>0:textproc/py-sphinx@${PY_FLAVOR} \
+		${PYTHON_PKGNAMEPREFIX}tox>0:devel/py-tox@${PY_FLAVOR}
+
+USES=		python
+USE_GITHUB=	yes
+GH_ACCOUNT=	miguelgrinberg
+GH_PROJECT=	${PORTNAME:tl}
+USE_PYTHON=	autoplist pep517
+
+DOCSDIR=	${PREFIX}/share/doc/${PYTHON_PKGNAMEPREFIX}${PORTNAME}
+
+NO_ARCH=	yes
+
+PLIST_FILES=	share/man/man1/${PORTNAME:tl}.1.gz
+PORTDOCS=	*
+PORTEXAMPLES=	*
+
+OPTIONS_DEFINE=	DOCS EXAMPLES
+
+do-build-DOCS-on:
+	(cd ${WRKSRC} && \
+		${SETENV} sphinx-build-${PYTHON_VER} -b html docs docs/_build/html)
+
+post-build:
+	(cd ${WRKSRC} && \
+		${SETENV} sphinx-build-${PYTHON_VER} -b man docs docs/_build/man)
+
+post-install:
+	${INSTALL_MAN} ${WRKSRC}/docs/_build/man/${PORTNAME:tl}.1 \
+		${STAGEDIR}${PREFIX}/share/man/man1/
+
+post-install-DOCS-on:
+	${MKDIR} ${STAGEDIR}${DOCSDIR}
+	(cd ${WRKSRC}/docs/_build/html && \
+		${COPYTREE_SHARE} . ${STAGEDIR}${DOCSDIR}/ "-not -name .buildinfo -not -regex ^./.doctrees.* -not -regex ^./_sources.*")
+
+post-install-EXAMPLES-on:
+	${MKDIR} ${STAGEDIR}${EXAMPLESDIR}
+	(cd ${WRKSRC}/example && \
+		${COPYTREE_SHARE} . ${STAGEDIR}${EXAMPLESDIR})
+
+do-test:
+	(cd ${WRKSRC} && \
+		${SETENV} ${TEST_ENV} tox-${PYTHON_VER} -e ${PY_FLAVOR})
+
+.include <bsd.port.mk>
diff --git a/www/py-flask-paranoid/distinfo b/www/py-flask-paranoid/distinfo
new file mode 100644
--- /dev/null
+++ b/www/py-flask-paranoid/distinfo
@@ -0,0 +1,3 @@
+TIMESTAMP = 1703662543
+SHA256 (miguelgrinberg-flask-paranoid-v0.3.0_GH0.tar.gz) = cab9f54e382707c31eb5ad58e1ce3b371ecd0d5d4f3385f9cf01bd13a2e1d9ec
+SIZE (miguelgrinberg-flask-paranoid-v0.3.0_GH0.tar.gz) = 102495
diff --git a/www/py-flask-paranoid/pkg-descr b/www/py-flask-paranoid/pkg-descr
new file mode 100644
--- /dev/null
+++ b/www/py-flask-paranoid/pkg-descr
@@ -0,0 +1,14 @@
+Flask-Paranoid is a simple extension for the Flask microframework that protects
+the application against certain attacks in which the user session cookie is
+stolen and then used by the attacker.
+
+When a client connects to the application for the first time, a token that
+represents certain characteristics of this client is generated and stored. In
+succesive requests sent by this client, this token is regenerated and compared
+against the stored one. If the tokens are different, it is assumed that the
+client is sending requests from a different environment than the one in which
+the session was originally created, so in this case the session is destroyed
+and the request rejected as a preventive measure.
+
+By default, the token is generated from the IP address and the user agent of
+the client.