Block Traffic by IP Address in Joomla

A single visitor is hammering your contact form, scraping your catalogue, or leaving spam faster than you can moderate it, and every request comes from the same address. You want that address gone today, not after you install and configure a full security suite, and you may not have access to .htaccess on managed hosting. A few lines of code can block an IP address in Joomla instead. You can add them with one PHP snippet in Code Snippets.

The PHP snippet code

Set Code Type to PHP, then use this snippet. It reads the visitor's IP address on every frontend page load and compares it to your block list before the page is rendered. Matching is done from the start of the address, so a full address like 203.0.113.10 blocks one visitor, while a prefix like 198.51.100. blocks that entire range. Blocked visitors get a 403 Forbidden response and a short message instead of your site.

use Joomla\CMS\Factory;

// IP addresses or prefixes to block.
$blockedIPs = [
    '203.0.113.10',
    '198.51.100.',
];

// Message shown to blocked visitors.
$message = 'Access denied.';

// Do not edit below.

$app = Factory::getApplication();
$ip  = (string) $app->getInput()->server->getString('REMOTE_ADDR', '');

if ($ip !== '')
{
    foreach ($blockedIPs as $blockedIP)
    {
        $blockedIP = trim($blockedIP);

        if ($blockedIP === '' || strpos($ip, $blockedIP) !== 0)
        {
            continue;
        }

        $app->setHeader('Status', '403 Forbidden', true);
        $app->sendHeaders();

        echo $message;

        $app->close();
    }
}

Tip: If your site sits behind Cloudflare or another reverse proxy, REMOTE_ADDR holds the proxy's address, not the visitor's. In that case read HTTP_CF_CONNECTING_IP (Cloudflare) or the first address in HTTP_X_FORWARDED_FOR instead, and only trust those headers when you know the proxy sets them.

How to add this snippet

1. Install Code Snippets if it isn't installed already.
2. Log into your Joomla backend.
3. Go to Components → Tassos Code Snippets.
4. Click New.
5. Enter a title, for example Block IP addresses.
6. Set Code Type to PHP.
7. Set Insertion Method to Auto-Insert Locations.
8. Set Location to On Page Load.
9. Paste the code above into the editor.
10. Replace the sample addresses with the ones you want to block.
11. Click Save & Close.

PHP snippets run on the frontend of your site, so this protects your public pages. Your Joomla administrator isn't affected.

Check that it works

Visit your site from an address on your list. You should see the "Access denied." message instead of your page, while every other visitor sees your site as usual. The block also covers your RSS feeds.

To stop crawlers by name instead of by address, see Block Bot Traffic in Joomla. To shut out whole countries, see Block Traffic by Country in Joomla. To learn more about how PHP snippets work, read the PHP snippet docs.