Banned users / IPs
Ban by user, IP, or email. Full user bans revoke sessions and add auto-linked rows. Exact IP only (no CIDR).
Banned users / IPs
Block sign-in and registration by account, IP, or email.
Where to find it
Admin → Users → Banned users / IPs (/admin/users/bans); Add ban (/admin/users/bans/new)
How it works
Two tables: Banned users and Banned IPs & emails. Types: IP, Email, User account. Reason required; Expires optional (must be future). Exact IPv4/IPv6 only - no CIDR.
| Type | Effect |
|---|---|
| User account | Full ban via applyFullUserBan: bannedAt, revoke sessions/API keys, auto-link email/IP rows ([auto:user-ban]) |
| IP / Email | Block login/signup for that target without necessarily setting bannedAt |
Edit user Status BANNED and Add ban → User both create full bans. Site admin email cannot be banned.
Unban tip: Setting Edit user Status back to OK clears the user ban and [auto:user-ban]* linked rows. Deleting only one linked IP/email row from this page does not fully unban the account.
Auto bans from failed-login / multi-IP rules use Settings max login attempts / IPs per hour (empty = disabled; window is in-process memory).
Common problems
Unbanned an IP but user still locked out
Clear the user ban (prefer Edit user → OK) and remaining email ban rows.