Description
PHP Drupal Firewall protects your site by blocking abusive visitors as early as possible in the request, before Drupal finishes loading.
When protection is enabled, every request is checked:
- If the visitor IP is already a known offender, it gets a 403 Forbidden.
- If the IP matches one of your manual deny rules (single IP, CIDR block or hyphen range, IPv4 or IPv6), it gets a 403.
- Otherwise the requested URL is inspected. If it matches a scanner signature, the IP is recorded and the request gets a 403.
Built-in scanner signatures: .env, settings.php, .git.
You can add your own substring patterns too.
Proxy / CDN aware
Choose which header carries the real visitor IP: REMOTE_ADDR,
Cloudflare (CF-Connecting-IP), X-Forwarded-For,
X-Real-IP, or a custom header — so the module works correctly behind nginx,
Varnish, a load balancer or a CDN.
Runs early
When protection is enabled, the deny check runs at an early stage of Drupal's bootstrap, before the full site is loaded, so bad requests are rejected while consuming as little CPU and resources as possible.
Exports
- CSV of the automatic offenders (optionally including the detection timestamp).
- A ufw script, e.g.
ufw insert 1 deny from 185.225.69.214 to any.
Specifications
PHP Drupal Firewall
- Unlimited manual deny rules
- Unlimited custom URL patterns
- Unlimited stored automatic offenders
- Automatic updates
Frequently Asked Questions
Does it work behind Cloudflare or a reverse proxy?
Yes. In the settings, choose the header that carries the real client IP for your setup. Only trust a forwarded header if your server genuinely sits behind that proxy, otherwise the value can be spoofed.
What happens when protection is disabled?
Nothing is blocked and no offenders are collected. Your existing rules are kept.
Where is the data stored?
In three custom database tables created by the module: one for configuration, one for the manual deny rules and one for the automatic offenders.
Can I export the blocklist to my server firewall?
Yes. Export the automatic offenders as a ufw script or as CSV from the settings page.
Is it fast?
It is very fast and really useful. Every site should have a plugin like this.
Screenshot
