Search by

yu-dev / module-firewall

Magento 2 firewall: IP-based visitor tracking, request logging, wildcard IP-range blocking, and exact-IP blocking across storefront, admin, REST, SOAP and GraphQL, with an extensible checker chain for future country, User-Agent, and rate-limit rules.

Maintainers

Package info

github.com/yuriyakishin/magento2-firewall

Type:magento2-module

pkg:composer/yu-dev/module-firewall

Transparency log

Statistics

Installs: 3

Dependents: 0

Suggesters: 0

Stars: 0

Open Issues: 0

Security

Advisories: 0

Aikido package health analysis

v1.1.0 2026-08-11 13:38 UTC

Requires

  • php: >=8.1
  • magento/framework: *
  • magento/module-backend: *
  • magento/module-config: *
  • magento/module-ui: *

Requires (Dev)

Suggests

None

Provides

None

Conflicts

None

Replaces

None

MIT c63370efd3db0ee6004cc3447bd6d67f420a89bc

securityecommercefirewallmagentowafmagento2ip-blacklistbot-protectionip-blockingvisitor-trackingrequest-logip-range-blocking

Published on Packagist.org on 2026-08-11 13:40 UTC

This package is auto-updated.

Last update: 2026-08-11 14:05:55 UTC

README

IP-based firewall and visitor tracking for Magento 2. Records every visitor IP and request, lets admins block/unblock IPs, and rejects blocked IPs before the request is processed — across storefront, admin, REST, SOAP, and GraphQL alike.

Features

  • Visitor tracking — every distinct IP (IPv4 and IPv6) is recorded with first/last seen timestamps and a request count.
  • Request log — every request is logged with IP, URL, method, area, user agent, and response status.
  • Blocking — block or unblock any IP from the admin, including IPs that have never generated traffic. Rejected requests return a configurable HTTP status code (403 by default).
  • IP range blocking — block or unblock whole ranges via wildcard patterns (160.79.106.*, 2a03:2880:*) from a dedicated IP Rules grid, independent of the exact-IP blocklist and individually enable/disable-able.
  • Proxy-aware IP resolution — reads the real client IP from a configurable header (CF-Connecting-IP, X-Forwarded-For, or the raw connection) instead of trusting the reverse proxy's own address.
  • Self-lockout protection — a configurable IP allowlist that can never be blocked.
  • Per-area logging control — tracking and logging can be scoped to only the areas you care about (e.g. skip Admin or REST API traffic) without affecting blocking, which always applies everywhere.
  • Admin grids — Visitor IPs, Requests, and Blocked IPs, each with filtering and mass actions where relevant.
  • Extensible — blocking runs through a pluggable checker chain (Yu\Firewall\Api\RequestCheckerInterface); adding country blocking, User-Agent filtering, bot detection, or rate limiting is a new checker class and one di.xml entry, no changes to existing code.

Requirements

  • Magento 2.4+

Installation

composer require yu-dev/module-firewall
bin/magento module:enable Yu_Firewall
bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento cache:flush

Configuration

Stores > Configuration > Security > Firewall

  • General — enable/disable the module, blocked status code, client IP source, IP allowlist.
  • Logging — enable/disable visitor tracking and request logging independently, and restrict both to specific areas.

Admin

Firewall menu (top-level, next to Stores/System):

  • Visitor IPs — every IP seen, with Block/Unblock actions (single and mass).
  • Requests — the full request log, filterable by IP, area, status, and blocked state.
  • Blocked IPs — currently blocked IPs, with an "Add New" form to block an IP manually before it ever visits.
  • IP Rules — wildcard-pattern range blocks (e.g. 160.79.106.*), each individually enable/disable-able, separate from the exact-IP blocklist.

License

MIT.