Block User Registration by Email Address in Joomla

Half of your new accounts come from throwaway addresses at mailinator.com or from the same 2 spam domains, and none of those people ever log in. Or the opposite problem: your site is for staff, and sign-ups should only work with a company address. You can block user registration by email address in Joomla with one PHP snippet in Code Snippets.

The PHP snippet code

The snippet runs right before Joomla stores a new account. It compares the email address with your list and, depending on the mode, cancels the registration and shows your message on the form. Logins, profile edits and existing accounts aren't affected.

use Joomla\CMS\Factory;

// Email domains or full addresses. A * matches anything, so '*.ru'
// covers every domain that ends in .ru.
$list = [
    'mailinator.com',
    '*.ru',
    'spammer@example.com',
];

// 'block' rejects addresses that match the list.
// 'allow' accepts only addresses that match, for example your company domain.
$mode = 'block';

// Message shown on the registration form instead of the welcome message.
$message = 'Registration with this email address is not allowed.';

// Do not edit below.

$app = Factory::getApplication();

$app->registerEvent('onUserBeforeSave', function ($event) use ($list, $mode, $message)
{
    // Only new accounts. Profile edits pass through.
    if (!$event->getArgument('isNew', $event->getArgument(1, false)))
    {
        return;
    }

    $data   = $event->getArgument('data', $event->getArgument(2, []));
    $email  = strtolower(trim($data['email'] ?? ''));
    $domain = substr(strrchr($email, '@'), 1);
    $listed = false;

    foreach ($list as $pattern)
    {
        $pattern = strtolower(trim($pattern));

        if ($pattern === '')
        {
            continue;
        }

        // Patterns with an @ match the full address, the rest match the domain.
        $subject = strpos($pattern, '@') === false ? $domain : $email;

        if (fnmatch($pattern, $subject))
        {
            $listed = true;
            break;
        }
    }

    $blocked = $mode === 'allow' ? !$listed : $listed;

    if ($blocked)
    {
        // Joomla cancels the registration and shows this message.
        throw new RuntimeException($message);
    }
});

Change the 3 settings at the top:

• $list: domains or full addresses. A domain like mailinator.com matches every address at that domain. A * matches anything, so *.ru covers every domain that ends in .ru. An entry with an @ matches one full address. The list isn't case sensitive.
• $mode: keep 'block' to reject the addresses on your list. Set it to 'allow' to accept only the addresses on your list, for example your company domain, and reject everything else.
• $message: the text Joomla shows on the registration form. It appears after "Registration failed:".

How to add this snippet

1. Install Code Snippets if it isn't installed already.
2. Log into your Joomla backend.
3. Go to Components → Tassos Code Snippets.
4. Click New.
5. Enter a title, for example Block registration by email.
6. Set Code Type to PHP.
7. Set Insertion Method to Auto-Insert Locations.
8. Set Location to On Page Load.
9. Paste the code above into the editor.
10. Replace the sample list with your own domains and addresses.
11. Click Save & Close.

Check that it works

1. Open your site's registration page in a private browser window.
2. Submit the form with an address at a blocked domain, for example test@mailinator.com.

Joomla shows "Registration failed: Registration with this email address is not allowed." and creates no account. Submit the form again with an address that isn't on the list, and the registration goes through.

To block sign-ups by IP address, country or username, see Block User Registration by IP Address in Joomla, Block User Registration by Country in Joomla and Block User Registration with Certain Usernames in Joomla. To learn more about how PHP snippets work, read the PHP snippet docs.