⚠️ Status: untested. This extension is provided as-is and has not been tested in production. Please feel free to fork, modify, improve, and open pull requests.

Licensed under GNU GPLv3 (see LICENSE).

IP Block Protection - XenForo 2 Add-on

Screens every front-end request against the ip-block.com IP-screening service before the controller action runs. Blocked visitors are redirected (or shown an HTTP 403); everyone else is untouched.

• Platform: XenForo 2
• Tested against: XenForo 2.3.11 (2.3.x line)
• Requires: PHP 7.2+ (uses XenForo's bundled Guzzle HTTP client)
• Add-on ID: IpBlock/Protection

How it works

Concern	Implementation
Earliest hook	controller_pre_dispatch code-event listener
Never lock out the Admin CP	Listener runs only when \XF::app() is a \XF\Pub\App
Real client IP	REMOTE_ADDR, or CF-Connecting-IP / X-Forwarded-For when behind a proxy
Whitelist	Always honoured, checked before any API call
Caching	\XF::app()->cache(), keyed by md5(ip|user_agent|referrer), TTL configurable
Fail mode	On timeout / error / non-2xx / missing action, apply fail open (default)
API call	Guzzle POST, 1 second timeout, api_key in the JSON body

API contract

POST https://api.ip-block.com/v1/check
Content-Type: application/json

{ "api_key": "...", "site_id": "...", "ip": "...", "user_agent": "...", "referrer": "..." }

Response: {"action":"allow"} or {"action":"block"}. Blocked only when action === "block".

Files

src/addons/IpBlock/Protection/
├── addon.json                          Add-on manifest
├── Setup.php                           Install/upgrade/uninstall (options + phrases)
├── Listener.php                        controller_pre_dispatch listener
├── Checker.php                         Real IP, whitelist, cache, fail mode, block
├── Client.php                          Guzzle HTTP client (1s timeout)
├── _data/code_event_listeners.xml      Declarative listener registration
└── README.md

Installation

1. Copy src/addons/IpBlock/ into your XenForo src/addons/ directory so the path is src/addons/IpBlock/Protection/.
2. Admin CP -> Add-ons -> find IP Block Protection -> Install.
3. Admin CP -> Options -> IP Block: enter your Site ID and API key, then turn on Enable IP screening.

Alternatively from the command line:

php cmd.php xf-addon:install IpBlock/Protection

Configuration (Admin CP -> Options -> IP Block)

Option	Default	Notes
Enable IP screening	Off	Master switch
Site ID	(empty)	Your ip-block.com site id
API key	(empty)	Sent in the request body
API URL	https://api.ip-block.com/v1/check
Fail open	On	Allow visitors when the API is unreachable
Cache lifetime	300	Seconds; 0 = check every request
Behind a proxy / CDN	Off	Read real IP from CF / XFF headers
Block action	redirect	redirect or message (HTTP 403)
Block message	(text)	Used with the message action
IP whitelist	(empty)	One IP per line, always allowed

Uninstall

Admin CP -> Add-ons -> IP Block Protection -> Uninstall. All options and phrases are removed.

License

GNU General Public License v2.0 only.