Banned users / IPs

Ban by user, IP, or email. Full user bans revoke sessions and add auto-linked rows. Exact IP only (no CIDR).

Banned users / IPs

Block sign-in and registration by account, IP, or email.

Where to find it

Admin → UsersBanned users / IPs (/admin/users/bans); Add ban (/admin/users/bans/new)

How it works

Two tables: Banned users and Banned IPs & emails. Types: IP, Email, User account. Reason required; Expires optional (must be future). Exact IPv4/IPv6 only - no CIDR.

Type Effect
User account Full ban via applyFullUserBan: bannedAt, revoke sessions/API keys, auto-link email/IP rows ([auto:user-ban])
IP / Email Block login/signup for that target without necessarily setting bannedAt

Edit user Status BANNED and Add ban → User both create full bans. Site admin email cannot be banned.

Unban tip: Setting Edit user Status back to OK clears the user ban and [auto:user-ban]* linked rows. Deleting only one linked IP/email row from this page does not fully unban the account.

Auto bans from failed-login / multi-IP rules use Settings max login attempts / IPs per hour (empty = disabled; window is in-process memory).

Common problems

Unbanned an IP but user still locked out

Clear the user ban (prefer Edit user → OK) and remaining email ban rows.

Related