Block Traffic by Country in Joomla

Your contact form fills up with spam from 2 countries you've never sold to, or fake sign-ups arrive from the same region every night. The senders switch IP addresses every day, so a list of blocked addresses never stops growing. Blocking the whole country covers all of them at once. You can block visitors by country in Joomla with one PHP snippet in Code Snippets.

The snippet finds each visitor's country with TGeoIP, the free geolocation plugin that installs together with Code Snippets. The lookup runs on your own server from a local database, so visitor addresses never go to an outside service.

Before you start

TGeoIP needs the free MaxMind GeoLite2 database to tell where an address comes from. If you haven't set it up yet, enable geolocation first: add a free MaxMind license key to the System - Tassos GeoIP plugin and click Update Database.

The PHP snippet code

The snippet looks up the visitor's country on every frontend page load, before Joomla builds the page. Visitors from a blocked country get a 403 Forbidden response and a short message instead of your site.

use Joomla\CMS\Factory;
use Tassos\Framework\Helpers\Geo;

// Two-letter country codes, for example 'CN' for China or 'GR' for Greece.
$countries = [
    'CN',
    'RU',
];

// 'block' keeps out visitors from the countries above.
// 'allow' lets in only visitors from the countries above.
$mode = 'block';

// Message shown to blocked visitors.
$message = 'Access denied.';

// Do not edit below.

// No Tassos framework means no country lookup, so let everyone in.
if (!class_exists(Geo::class))
{
    return;
}

$country = (string) Geo::getVisitorCountryCode();

// The country is unknown, for example a local address or a missing GeoIP database.
// Let the visitor in rather than risk locking everyone out.
if ($country === '')
{
    return;
}

$countries = array_map('strtoupper', array_map('trim', $countries));
$listed    = in_array($country, $countries, true);
$blocked   = $mode === 'allow' ? !$listed : $listed;

if (!$blocked)
{
    return;
}

$app = Factory::getApplication();

$app->setHeader('Status', '403 Forbidden', true);
$app->sendHeaders();

echo $message;

$app->close();

Change the 3 settings at the top:

• $countries: 2-letter country codes, for example CN for China, RU for Russia or GR for Greece. You'll find every code in the ISO 3166-1 alpha-2 list. Lowercase works too.
• $mode: keep 'block' to keep out the countries on your list. Set it to 'allow' to let in only those countries and block everyone else.
• $message: the text blocked visitors see.

When the snippet can't tell where a visitor comes from, for example because the GeoIP database is missing, it lets them in. A broken lookup never locks out your real visitors.

How to add this snippet

1. Install Code Snippets if it isn't installed already.
2. Log into your Joomla backend.
3. Go to Components → Tassos Code Snippets.
4. Click New.
5. Enter a title, for example Block countries.
6. Set Code Type to PHP.
7. Set Insertion Method to Auto-Insert Locations.
8. Set Location to On Page Load.
9. Paste the code above into the editor.
10. Replace the sample country codes with the ones you want to block.
11. Click Save & Close.

PHP snippets run on the frontend of your site, so the block covers your pages and RSS feeds. Your Joomla administrator isn't affected.

Check that it works

1. Add your own country code to $countries and save the snippet.
2. Open your site's home page in a private browser window.

You should see "Access denied." instead of your page. Remove your country from the list and save again, and your site comes back. Your administrator keeps working the whole time, so you can always log in there and fix the list.

If visitors from a blocked country still get in

• Your site sits behind Cloudflare or another proxy. Joomla may then see the proxy's address instead of the visitor's, so the snippet checks the wrong country. Go to System → Global Configuration, open the Server tab, set Behind Load Balancer to Yes, and click Save & Close. Leave it off when there's no proxy, because it lets visitors fake their address.
• The GeoIP database is missing. The snippet then lets everyone in. Open the System - Tassos GeoIP plugin and click Update Database.
• The visitor uses a VPN. The snippet sees the VPN's address, so the visitor appears to come from the VPN's country.

To block single addresses instead of whole countries, see Block Traffic by IP Address in Joomla. To stop crawlers by name, see Block Bot Traffic in Joomla. To learn more about how PHP snippets work, read the PHP snippet docs.