Block Bad Bots and Scrapers in Joomla

Your analytics show traffic spikes that never convert, your server load climbs at odd hours, and the access log is full of crawlers you have never heard of. Aggressive scrapers and AI training bots ignore robots.txt, so asking politely does nothing. Blocking bad bots in Joomla by their user agent stops them at the door, and you don't have to install a full firewall extension to do it. You can do it with Code Snippets using a simple PHP snippet.

The PHP Snippet Code

Set Code Type to PHP, then use this snippet. On every frontend page load it looks at the visitor's user agent string and compares it to a list of fragments you define. Matching is case-insensitive and matches anywhere in the string, so ahrefsbot catches every version of that crawler. Blocked bots receive a 403 Forbidden response before Joomla renders anything, which saves the database queries the page would have cost.

use Joomla\CMS\Factory;

// Any user agent containing one of these fragments will be blocked.
$blockedAgents = [
    'ahrefsbot',
    'semrushbot',
    'mj12bot',
    'dotbot',
    'petalbot',
    'gptbot',
    'ccbot',
];

// Message shown to blocked bots.
$message = 'Access denied.';

// Do not edit below.

$app       = Factory::getApplication();
$userAgent = strtolower((string) $app->getInput()->server->getString('HTTP_USER_AGENT', ''));

if ($userAgent !== '')
{
    foreach ($blockedAgents as $blockedAgent)
    {
        $blockedAgent = strtolower(trim($blockedAgent));

        if ($blockedAgent === '' || strpos($userAgent, $blockedAgent) === false)
        {
            continue;
        }

        $app->setHeader('Status', '403 Forbidden', true);
        $app->sendHeaders();

        echo $message;

        $app->close();
    }
}

Tip: Keep each fragment specific. Short strings like bot or spider match Googlebot and Bingbot too, and blocking those removes your site from search results. Never add googlebot, bingbot, or duckduckbot to this list unless you are certain that is what you want.

An empty user agent is left alone on purpose, because some legitimate clients and monitoring tools send none. Add a check for it only if your logs show it being abused.

How to add this snippet

Install Code Snippets if it is not installed already.
Go to your Joomla Administrator area.
Open Components → Code Snippets.
Click New.
Select PHP as the snippet type.
Paste the code to block bad bots above and adjust the list to the crawlers you see in your own logs.
Select Insertion Method → Page Load.
Publish the snippet.
Optionally, open the Conditional Logic tab to restrict which pages or users the snippet runs on. Leave it empty to run it site-wide. Learn more in Using Conditional Logic.

Congrats! You've just added bot blocking functionality to Joomla without installing another plugin or adding unnecessary bloat to your site.

For instance, to learn more about how the PHP Snippet works, visit our documentation: https://www.tassos.gr/docs/tassos-code-snippets/types/php