yu-dev/module-firewall

Magento 2 firewall: IP-based visitor tracking, request logging, and blocking across storefront, admin, REST, SOAP and GraphQL, with an extensible checker chain for future CIDR, country, User-Agent, and rate-limit rules.

v1.0.0 2026-08-05 17:51 UTC

Requires

• php: >=8.1
• magento/framework: *
• magento/module-backend: *
• magento/module-config: *
• magento/module-ui: *

Requires (Dev)

• phpunit/phpunit: ^9.5

MIT

• Yuriy Akishin

• security
• ecommerce
• firewall
• magento
• waf
• magento2
• ip-blacklist
• bot-protection
• ip-blocking
• visitor-tracking
• request-log

Published on Packagist.org on 2026-08-05 17:55 UTC

README

IP-based firewall and visitor tracking for Magento 2. Records every visitor IP and request, lets admins block/unblock IPs, and rejects blocked IPs before the request is processed — across storefront, admin, REST, SOAP, and GraphQL alike.

Features

• Visitor tracking — every distinct IP (IPv4 and IPv6) is recorded with first/last seen timestamps and a request count.
• Request log — every request is logged with IP, URL, method, area, user agent, and response status.
• Blocking — block or unblock any IP from the admin, including IPs that have never generated traffic. Rejected requests return a configurable HTTP status code (403 by default).
• Proxy-aware IP resolution — reads the real client IP from a configurable header (CF-Connecting-IP, X-Forwarded-For, or the raw connection) instead of trusting the reverse proxy's own address.
• Self-lockout protection — a configurable IP allowlist that can never be blocked.
• Per-area logging control — tracking and logging can be scoped to only the areas you care about (e.g. skip Admin or REST API traffic) without affecting blocking, which always applies everywhere.
• Admin grids — Visitor IPs, Requests, and Blocked IPs, each with filtering and mass actions where relevant.
• Extensible — blocking runs through a pluggable checker chain (Yu\Firewall\Api\RequestCheckerInterface); adding CIDR ranges, country blocking, User-Agent filtering, bot detection, or rate limiting is a new checker class and one di.xml entry, no changes to existing code.

Requirements

• Magento 2.4+

Installation

composer require yu-dev/module-firewall
bin/magento module:enable Yu_Firewall
bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento cache:flush

Configuration

Stores > Configuration > Security > Firewall

• General — enable/disable the module, blocked status code, client IP source, IP allowlist.
• Logging — enable/disable visitor tracking and request logging independently, and restrict both to specific areas.

Admin

Firewall menu (top-level, next to Stores/System):

• Visitor IPs — every IP seen, with Block/Unblock actions (single and mass).
• Requests — the full request log, filterable by IP, area, status, and blocked state.
• Blocked IPs — currently blocked IPs, with an "Add New" form to block an IP manually before it ever visits.

License

MIT.