---
title: "Block Traffic by Country in Joomla - Code Snippets"
description: "Keep spam, fake sign-ups and unwanted traffic off your Joomla site by blocking visitors from the countries you choose, using one PHP snippet."
url: "https://www.tassos.gr/docs/code-snippets/howto/access-control-security/block-countries"
date: "2026-10-23T00:37:36+00:00"
language: "en-GB"
---

[ Home ](https://www.tassos.gr/docs) / [ Code Snippets ](https://www.tassos.gr/docs/code-snippets) / [ How-to Guides ](https://www.tassos.gr/docs/code-snippets/howto) / [ Access Control & Security ](https://www.tassos.gr/docs/code-snippets/howto/access-control-security)

#  Block Traffic by Country in Joomla

##  Keep spam, fake sign-ups and unwanted traffic off your Joomla site by blocking visitors from the countries you choose, using one PHP snippet.

 ![Block Traffic by Country in Joomla](https://www.tassos.gr/images/2026/10/code-snippets-block-countries-v2-card.png) Heads up! This article contains PHP code and is intended for developers. We offer this code as a courtesy, but don't provide support for code customizations or 3rd party development.

Your contact form fills up with spam from 2 countries you've never sold to, or fake sign-ups arrive from the same region every night. The senders switch IP addresses every day, so a list of blocked addresses never stops growing. Blocking the whole country covers all of them at once. You can block visitors by country in Joomla with one PHP snippet in Code Snippets.

The snippet finds each visitor's country with TGeoIP, the free geolocation plugin that installs together with Code Snippets. The lookup runs on your own server from a local database, so visitor addresses never go to an outside service.

## [Before you start](#before-you-start)

TGeoIP needs the free MaxMind GeoLite2 database to tell where an address comes from. If you haven't set it up yet, [enable geolocation](https://www.tassos.gr/docs/common/features/enable-geolocation-features-in-tassos-gr-extensions) first: add a free MaxMind license key to the **System - Tassos GeoIP** plugin and click **Update Database**.

## [The PHP snippet code](#the-php-snippet-code)

The snippet looks up the visitor's country on every frontend page load, before Joomla builds the page. Visitors from a blocked country get a `403 Forbidden` response and a short message instead of your site.

```
use Joomla\CMS\Factory;
use Tassos\Framework\Helpers\Geo;

// Two-letter country codes, for example 'CN' for China or 'GR' for Greece.
$countries = [
    'CN',
    'RU',
];

// 'block' keeps out visitors from the countries above.
// 'allow' lets in only visitors from the countries above.
$mode = 'block';

// Message shown to blocked visitors.
$message = 'Access denied.';

// Do not edit below.

// No Tassos framework means no country lookup, so let everyone in.
if (!class_exists(Geo::class))
{
    return;
}

$country = (string) Geo::getVisitorCountryCode();

// The country is unknown, for example a local address or a missing GeoIP database.
// Let the visitor in rather than risk locking everyone out.
if ($country === '')
{
    return;
}

$countries = array_map('strtoupper', array_map('trim', $countries));
$listed    = in_array($country, $countries, true);
$blocked   = $mode === 'allow' ? !$listed : $listed;

if (!$blocked)
{
    return;
}

$app = Factory::getApplication();

$app->setHeader('Status', '403 Forbidden', true);
$app->sendHeaders();

echo $message;

$app->close();
```

Change the 3 settings at the top:

- `$countries`: 2-letter country codes, for example `CN` for China, `RU` for Russia or `GR` for Greece. You'll find every code in the [ISO 3166-1 alpha-2 list](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2). Lowercase works too.
- `$mode`: keep `'block'` to keep out the countries on your list. Set it to `'allow'` to let in only those countries and block everyone else.
- `$message`: the text blocked visitors see.

When the snippet can't tell where a visitor comes from, for example because the GeoIP database is missing, it lets them in. A broken lookup never locks out your real visitors.

 Allow mode also blocks search engines that crawl from other countries. Googlebot crawls mainly from US addresses, so if you only allow Greece, Google can't reach your pages and they can drop out of search results.

## [How to add this snippet](#how-to-add-this-snippet)

1. Install [Code Snippets](https://www.tassos.gr/docs/code-snippets/getting-started/how-to-install) if it isn't installed already.
2. Log into your Joomla backend.
3. Go to **Components** → **Tassos Code Snippets**.
4. Click **New**.
5. Enter a title, for example *Block countries*.
6. Set **Code Type** to **PHP**.
7. Set **Insertion Method** to **Auto-Insert Locations**.
8. Set **Location** to **On Page Load**.
9. Paste the code above into the editor.
10. Replace the sample country codes with the ones you want to block.
11. Click **Save & Close**.

PHP snippets run on the frontend of your site, so the block covers your pages and RSS feeds. Your Joomla administrator isn't affected.

## [Check that it works](#check-that-it-works)

1. Add your own country code to `$countries` and save the snippet.
2. Open your site's home page in a private browser window.

You should see "Access denied." instead of your page. Remove your country from the list and save again, and your site comes back. Your administrator keeps working the whole time, so you can always log in there and fix the list.

## [If visitors from a blocked country still get in](#if-visitors-from-a-blocked-country-still-get-in)

- **Your site sits behind Cloudflare or another proxy.** Joomla may then see the proxy's address instead of the visitor's, so the snippet checks the wrong country. Go to **System** → **Global Configuration**, open the **Server** tab, set **Behind Load Balancer** to **Yes**, and click **Save & Close**. Leave it off when there's no proxy, because it lets visitors fake their address.
- **The GeoIP database is missing.** The snippet then lets everyone in. Open the **System - Tassos GeoIP** plugin and click **Update Database**.
- **The visitor uses a VPN.** The snippet sees the VPN's address, so the visitor appears to come from the VPN's country.

To block single addresses instead of whole countries, see [Block Traffic by IP Address in Joomla](https://www.tassos.gr/docs/code-snippets/howto/access-control-security/block-ip-address). To stop crawlers by name, see [Block Bot Traffic in Joomla](https://www.tassos.gr/docs/code-snippets/howto/access-control-security/block-bad-bots). To learn more about how PHP snippets work, read the [PHP snippet docs](https://www.tassos.gr/docs/code-snippets/types/php).

 Last updated on Oct 15th 2026 18:10