Block User Registration by Country in Joomla

Fake accounts arrive every night from 2 countries you've never sold to, and the senders change IP addresses faster than you can block them. You want the site to stay open to everyone, but registration only for the countries you serve. You can block user registration by country in Joomla with one PHP snippet in Code Snippets.

The snippet finds each visitor's country with TGeoIP, the free geolocation plugin that installs together with Code Snippets. The lookup runs on your own server from a local database, so visitor addresses never go to an outside service.

Before you start

TGeoIP needs the free MaxMind GeoLite2 database to tell where an address comes from. If you haven't set it up yet, enable geolocation first: add a free MaxMind license key to the System - Tassos GeoIP plugin and click Update Database.

The PHP snippet code

The snippet runs right before Joomla stores a new account. It looks up the visitor's country and, depending on the mode, cancels the registration and shows your message on the form. Everything else on the site keeps working for that visitor, and existing accounts can still log in.

use Joomla\CMS\Factory;
use Tassos\Framework\Helpers\Geo;

// Two-letter country codes, for example 'CN' for China or 'GR' for Greece.
$countries = [
    'CN',
    'RU',
];

// 'block' rejects sign-ups from the countries above.
// 'allow' accepts sign-ups only from the countries above.
$mode = 'block';

// Message shown on the registration form instead of the welcome message.
$message = 'Registration is not available in your country.';

// Do not edit below.

// No Tassos framework means no country lookup, so let everyone register.
if (!class_exists(Geo::class))
{
    return;
}

$app = Factory::getApplication();

$app->registerEvent('onUserBeforeSave', function ($event) use ($countries, $mode, $message)
{
    // Only new accounts. Profile edits pass through.
    if (!$event->getArgument('isNew', $event->getArgument(1, false)))
    {
        return;
    }

    $country = strtoupper((string) Geo::getVisitorCountryCode());

    // Unknown country, for example a local address or a missing GeoIP database.
    // Let the visitor register rather than lock everyone out.
    if ($country === '')
    {
        return;
    }

    $countries = array_map('strtoupper', array_map('trim', $countries));
    $listed    = in_array($country, $countries, true);
    $blocked   = $mode === 'allow' ? !$listed : $listed;

    if ($blocked)
    {
        // Joomla cancels the registration and shows this message.
        throw new RuntimeException($message);
    }
});

Change the 3 settings at the top:

• $countries: 2-letter country codes, for example CN for China, RU for Russia or GR for Greece. You'll find every code in the ISO 3166-1 alpha-2 list. Lowercase works too.
• $mode: keep 'block' to reject sign-ups from the countries on your list. Set it to 'allow' to accept sign-ups only from those countries and reject everyone else.
• $message: the text Joomla shows on the registration form. It appears after "Registration failed:".

When the snippet can't tell where a visitor comes from, for example because the GeoIP database is missing, it lets the registration through. A broken lookup never locks out your real visitors.

How to add this snippet

1. Install Code Snippets if it isn't installed already.
2. Log into your Joomla backend.
3. Go to Components → Tassos Code Snippets.
4. Click New.
5. Enter a title, for example Block registration by country.
6. Set Code Type to PHP.
7. Set Insertion Method to Auto-Insert Locations.
8. Set Location to On Page Load.
9. Paste the code above into the editor.
10. Replace the sample country codes with the ones you want to block.
11. Click Save & Close.

Check that it works

1. Add your own country code to $countries and save the snippet.
2. Open your site's registration page in a private browser window and submit the form with a test name and email.

Joomla shows "Registration failed: Registration is not available in your country." and creates no account. Remove your country from the list, save, and the same form goes through.

If sign-ups from a blocked country still get through

• Your site sits behind Cloudflare or another proxy. Joomla may then see the proxy's address instead of the visitor's, so the snippet checks the wrong country. Go to System → Global Configuration, open the Server tab, set Behind Load Balancer to Yes, and click Save & Close. Leave it off when there's no proxy, because it lets visitors fake their address.
• The GeoIP database is missing. The snippet then lets everyone register. Open the System - Tassos GeoIP plugin and click Update Database.
• The visitor uses a VPN. The snippet sees the VPN's address, so the visitor appears to come from the VPN's country.

To keep a country off the whole site rather than just the registration form, see Block Traffic by Country in Joomla. To block sign-ups by IP address, email address or username, see Block User Registration by IP Address in Joomla, Block User Registration by Email Address in Joomla and Block User Registration with Certain Usernames in Joomla. To learn more about how PHP snippets work, read the PHP snippet docs.