---
title: "Block User Registration by Country in Joomla - Code Snippets"
description: "Stop fake sign-ups from countries you never serve, or open Joomla registration only to the countries you do, using one PHP snippet."
url: "https://www.tassos.gr/docs/code-snippets/howto/access-control-security/block-registration-country"
date: "2026-10-22T22:26:00+00:00"
language: "en-GB"
---

[ Home ](https://www.tassos.gr/docs) / [ Code Snippets ](https://www.tassos.gr/docs/code-snippets) / [ How-to Guides ](https://www.tassos.gr/docs/code-snippets/howto) / [ Access Control & Security ](https://www.tassos.gr/docs/code-snippets/howto/access-control-security)

#  Block User Registration by Country in Joomla

##  Stop fake sign-ups from countries you never serve, or open Joomla registration only to the countries you do, using one PHP snippet.

 ![Block User Registration by Country in Joomla](https://www.tassos.gr/images/2026/10/code-snippets-block-registration-country-card.png) Heads up! This article contains PHP code and is intended for developers. We offer this code as a courtesy, but don't provide support for code customizations or 3rd party development.

Fake accounts arrive every night from 2 countries you've never sold to, and the senders change IP addresses faster than you can block them. You want the site to stay open to everyone, but registration only for the countries you serve. You can block user registration by country in Joomla with one PHP snippet in Code Snippets.

The snippet finds each visitor's country with TGeoIP, the free geolocation plugin that installs together with Code Snippets. The lookup runs on your own server from a local database, so visitor addresses never go to an outside service.

## [Before you start](#before-you-start)

TGeoIP needs the free MaxMind GeoLite2 database to tell where an address comes from. If you haven't set it up yet, [enable geolocation](https://www.tassos.gr/docs/common/features/enable-geolocation-features-in-tassos-gr-extensions) first: add a free MaxMind license key to the **System - Tassos GeoIP** plugin and click **Update Database**.

## [The PHP snippet code](#the-php-snippet-code)

The snippet runs right before Joomla stores a new account. It looks up the visitor's country and, depending on the mode, cancels the registration and shows your message on the form. Everything else on the site keeps working for that visitor, and existing accounts can still log in.

```
use Joomla\CMS\Factory;
use Tassos\Framework\Helpers\Geo;

// Two-letter country codes, for example 'CN' for China or 'GR' for Greece.
$countries = [
    'CN',
    'RU',
];

// 'block' rejects sign-ups from the countries above.
// 'allow' accepts sign-ups only from the countries above.
$mode = 'block';

// Message shown on the registration form instead of the welcome message.
$message = 'Registration is not available in your country.';

// Do not edit below.

// No Tassos framework means no country lookup, so let everyone register.
if (!class_exists(Geo::class))
{
    return;
}

$app = Factory::getApplication();

$app->registerEvent('onUserBeforeSave', function ($event) use ($countries, $mode, $message)
{
    // Only new accounts. Profile edits pass through.
    if (!$event->getArgument('isNew', $event->getArgument(1, false)))
    {
        return;
    }

    $country = strtoupper((string) Geo::getVisitorCountryCode());

    // Unknown country, for example a local address or a missing GeoIP database.
    // Let the visitor register rather than lock everyone out.
    if ($country === '')
    {
        return;
    }

    $countries = array_map('strtoupper', array_map('trim', $countries));
    $listed    = in_array($country, $countries, true);
    $blocked   = $mode === 'allow' ? !$listed : $listed;

    if ($blocked)
    {
        // Joomla cancels the registration and shows this message.
        throw new RuntimeException($message);
    }
});
```

Change the 3 settings at the top:

- `$countries`: 2-letter country codes, for example `CN` for China, `RU` for Russia or `GR` for Greece. You'll find every code in the [ISO 3166-1 alpha-2 list](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2). Lowercase works too.
- `$mode`: keep `'block'` to reject sign-ups from the countries on your list. Set it to `'allow'` to accept sign-ups only from those countries and reject everyone else.
- `$message`: the text Joomla shows on the registration form. It appears after "Registration failed:".

When the snippet can't tell where a visitor comes from, for example because the GeoIP database is missing, it lets the registration through. A broken lookup never locks out your real visitors.

## [How to add this snippet](#how-to-add-this-snippet)

1. Install [Code Snippets](https://www.tassos.gr/docs/code-snippets/getting-started/how-to-install) if it isn't installed already.
2. Log into your Joomla backend.
3. Go to **Components** → **Tassos Code Snippets**.
4. Click **New**.
5. Enter a title, for example *Block registration by country*.
6. Set **Code Type** to **PHP**.
7. Set **Insertion Method** to **Auto-Insert Locations**.
8. Set **Location** to **On Page Load**.
9. Paste the code above into the editor.
10. Replace the sample country codes with the ones you want to block.
11. Click **Save & Close**.

## [Check that it works](#check-that-it-works)

1. Add your own country code to `$countries` and save the snippet.
2. Open your site's registration page in a private browser window and submit the form with a test name and email.

Joomla shows "Registration failed: Registration is not available in your country." and creates no account. Remove your country from the list, save, and the same form goes through.

## [If sign-ups from a blocked country still get through](#if-sign-ups-from-a-blocked-country-still-get-through)

- **Your site sits behind Cloudflare or another proxy.** Joomla may then see the proxy's address instead of the visitor's, so the snippet checks the wrong country. Go to **System** → **Global Configuration**, open the **Server** tab, set **Behind Load Balancer** to **Yes**, and click **Save & Close**. Leave it off when there's no proxy, because it lets visitors fake their address.
- **The GeoIP database is missing.** The snippet then lets everyone register. Open the **System - Tassos GeoIP** plugin and click **Update Database**.
- **The visitor uses a VPN.** The snippet sees the VPN's address, so the visitor appears to come from the VPN's country.

To keep a country off the whole site rather than just the registration form, see [Block Traffic by Country in Joomla](https://www.tassos.gr/docs/code-snippets/howto/access-control-security/block-countries). To block sign-ups by IP address, email address or username, see [Block User Registration by IP Address in Joomla](https://www.tassos.gr/docs/code-snippets/howto/access-control-security/block-registration-ip), [Block User Registration by Email Address in Joomla](https://www.tassos.gr/docs/code-snippets/howto/access-control-security/block-registration-email) and [Block User Registration with Certain Usernames in Joomla](https://www.tassos.gr/docs/code-snippets/howto/access-control-security/block-registration-username). To learn more about how PHP snippets work, read the [PHP snippet docs](https://www.tassos.gr/docs/code-snippets/types/php).

 Last updated on Oct 15th 2026 15:10