---
title: "Block Traffic by IP Address in Joomla - Code Snippets"
description: "Stop spammers and scrapers from reaching your Joomla site by blocking their IP addresses in minutes, using one PHP snippet."
url: "https://www.tassos.gr/docs/code-snippets/howto/access-control-security/block-ip-address"
date: "2026-10-16T15:49:08+00:00"
language: "en-GB"
---

[ Home ](https://www.tassos.gr/docs) / [ Code Snippets ](https://www.tassos.gr/docs/code-snippets) / [ How-to Guides ](https://www.tassos.gr/docs/code-snippets/howto) / [ Access Control & Security ](https://www.tassos.gr/docs/code-snippets/howto/access-control-security)

#  Block Traffic by IP Address in Joomla

##  Stop spammers and scrapers from reaching your Joomla site by blocking their IP addresses in minutes, using one PHP snippet.

 ![Block Traffic by IP Address in Joomla](https://www.tassos.gr/images/2026/10/code-snippets-block-ip-address-v2-card.png) Heads up! This article contains PHP code and is intended for developers. We offer this code as a courtesy, but don't provide support for code customizations or 3rd party development.

A single visitor is hammering your contact form, scraping your catalogue, or leaving spam faster than you can moderate it, and every request comes from the same address. You want that address gone today, not after you install and configure a full security suite, and you may not have access to `.htaccess` on managed hosting. A few lines of code can block an IP address in Joomla instead. You can add them with one PHP snippet in Code Snippets.

## [The PHP snippet code](#the-php-snippet-code)

Set **Code Type** to `PHP`, then use this snippet. It reads the visitor's IP address on every frontend page load and compares it to your block list before the page is rendered. Matching is done from the start of the address, so a full address like `203.0.113.10` blocks one visitor, while a prefix like `198.51.100.` blocks that entire range. Blocked visitors get a `403 Forbidden` response and a short message instead of your site.

```
use Joomla\CMS\Factory;

// IP addresses or prefixes to block.
$blockedIPs = [
    '203.0.113.10',
    '198.51.100.',
];

// Message shown to blocked visitors.
$message = 'Access denied.';

// Do not edit below.

$app = Factory::getApplication();
$ip  = (string) $app->getInput()->server->getString('REMOTE_ADDR', '');

if ($ip !== '')
{
    foreach ($blockedIPs as $blockedIP)
    {
        $blockedIP = trim($blockedIP);

        if ($blockedIP === '' || strpos($ip, $blockedIP) !== 0)
        {
            continue;
        }

        $app->setHeader('Status', '403 Forbidden', true);
        $app->sendHeaders();

        echo $message;

        $app->close();
    }
}
```

**Tip:** If your site sits behind Cloudflare or another reverse proxy, `REMOTE_ADDR` holds the proxy's address, not the visitor's. In that case read `HTTP_CF_CONNECTING_IP` (Cloudflare) or the first address in `HTTP_X_FORWARDED_FOR` instead, and only trust those headers when you know the proxy sets them.

 Double-check your list before you save. If you block your own address by mistake, your site shows you the denied message, but your Joomla administrator keeps working, so you can log in there and unpublish the snippet.

## [How to add this snippet](#how-to-add-this-snippet)

1. Install [Code Snippets](https://www.tassos.gr/docs/code-snippets/getting-started/how-to-install) if it isn't installed already.
2. Log into your Joomla backend.
3. Go to **Components** → **Tassos Code Snippets**.
4. Click **New**.
5. Enter a title, for example *Block IP addresses*.
6. Set **Code Type** to **PHP**.
7. Set **Insertion Method** to **Auto-Insert Locations**.
8. Set **Location** to **On Page Load**.
9. Paste the code above into the editor.
10. Replace the sample addresses with the ones you want to block.
11. Click **Save & Close**.

PHP snippets run on the frontend of your site, so this protects your public pages. Your Joomla administrator isn't affected.

## [Check that it works](#check-that-it-works)

Visit your site from an address on your list. You should see the "Access denied." message instead of your page, while every other visitor sees your site as usual. The block also covers your RSS feeds.

To stop crawlers by name instead of by address, see [Block Bot Traffic in Joomla](https://www.tassos.gr/docs/code-snippets/howto/access-control-security/block-bad-bots). To shut out whole countries, see [Block Traffic by Country in Joomla](https://www.tassos.gr/docs/code-snippets/howto/access-control-security/block-countries). To learn more about how PHP snippets work, read the [PHP snippet docs](https://www.tassos.gr/docs/code-snippets/types/php).

 Last updated on Oct 15th 2026 18:10