Block User Registration by IP Address in Joomla

The same visitor keeps creating fake accounts on your site, and every one of them means another spam profile to delete. Joomla's registration form doesn't look at where a sign-up comes from. You can block user registration from specific IP addresses in Joomla with one PHP snippet in Code Snippets.

The PHP snippet code

The snippet runs right before Joomla stores a new account. When the visitor's address is on your list, Joomla cancels the registration and shows your message on the form. Logins, profile edits and existing accounts aren't affected, and the blocked visitor can still browse the site.

use Joomla\CMS\Factory;
use Joomla\Utilities\IpHelper;

// Addresses that can't register. A full address blocks one visitor.
// A prefix that ends in a dot, like '198.51.100.', blocks the whole range.
$blockedIPs = [
    '203.0.113.10',
    '198.51.100.',
];

// Message shown on the registration form instead of the welcome message.
$message = 'Registration is not available from your network.';

// Do not edit below.

$app = Factory::getApplication();

$app->registerEvent('onUserBeforeSave', function ($event) use ($blockedIPs, $message)
{
    // Only new accounts. Profile edits pass through.
    if (!$event->getArgument('isNew', $event->getArgument(1, false)))
    {
        return;
    }

    $ip = (string) IpHelper::getIp();

    foreach ($blockedIPs as $blockedIP)
    {
        $blockedIP = trim($blockedIP);

        if ($blockedIP === '')
        {
            continue;
        }

        $isPrefix = substr($blockedIP, -1) === '.';
        $matches  = $isPrefix ? strpos($ip, $blockedIP) === 0 : $ip === $blockedIP;

        if ($matches)
        {
            // Joomla cancels the registration and shows this message.
            throw new RuntimeException($message);
        }
    }
});

Change the 2 settings at the top:

• $blockedIPs: the addresses that can't register. A full address like 203.0.113.10 blocks that one visitor. A prefix that ends in a dot, like 198.51.100., blocks every address that starts with it.
• $message: the text Joomla shows on the registration form. It appears after "Registration failed:".

How to add this snippet

1. Install Code Snippets if it isn't installed already.
2. Log into your Joomla backend.
3. Go to Components → Tassos Code Snippets.
4. Click New.
5. Enter a title, for example Block registration by IP.
6. Set Code Type to PHP.
7. Set Insertion Method to Auto-Insert Locations.
8. Set Location to On Page Load.
9. Paste the code above into the editor.
10. Replace the sample addresses with the ones you want to block.
11. Click Save & Close.

Check that it works

1. Add your own IP address to $blockedIPs and save the snippet. A search for "what is my IP" shows your address.
2. Open your site's registration page in a private browser window and submit the form with a test name and email.

Joomla shows "Registration failed: Registration is not available from your network." and creates no account. Remove your address from the list, save, and the same form goes through.

If a blocked address still gets through

Your site may sit behind Cloudflare or another proxy. Joomla then sees the proxy's address instead of the visitor's, so the snippet compares the wrong address. Go to System → Global Configuration, open the Server tab, set Behind Load Balancer to Yes, and click Save & Close. Leave it off when there's no proxy, because it lets visitors fake their address.

To block visitors by email address, country or username, see Block User Registration by Email Address in Joomla, Block User Registration by Country in Joomla and Block User Registration with Certain Usernames in Joomla. To keep an address off the whole site, see Block Traffic by IP Address in Joomla. To learn more about how PHP snippets work, read the PHP snippet docs.