⚠️ Status: untested. This extension is provided as-is and has not been tested in production. Please feel free to fork, modify, improve, and open pull requests.

Licensed under GNU GPLv3 (see LICENSE).

IP Block Protection - MediaWiki Extension

Screens every front-end request against the ip-block.com IP-screening service on the BeforeInitialize hook. Blocked visitors are redirected (or shown an HTTP 403); everyone else is untouched.

• Platform: MediaWiki
• Tested against: MediaWiki 1.43 (LTS)
• Requires: MediaWiki 1.43.0+ (uses core HttpRequestFactory and object cache)
• Extension name: IpBlockProtection

How it works

Concern	Implementation
Earliest hook	BeforeInitialize (before page output for every index.php request)
Operator lockout safety	MediaWiki has no separate admin panel; the always-honoured $wgIpBlockWhitelist protects the operator
Real client IP	REMOTE_ADDR, or CF-Connecting-IP / X-Forwarded-For when behind a proxy
Whitelist	Always honoured, checked before any API call
Caching	Main object stash (BagOStuff), keyed by md5(ip|user_agent|referrer), TTL configurable
Fail mode	On timeout / error / non-2xx / missing action, apply fail open (default)
API call	HttpRequestFactory POST, 1 second timeout, api_key in the JSON body

API contract

POST https://api.ip-block.com/v1/check
Content-Type: application/json

{ "api_key": "...", "site_id": "...", "ip": "...", "user_agent": "...", "referrer": "..." }

Response: {"action":"allow"} or {"action":"block"}. Blocked only when action === "block".

Installation

1. Copy the IpBlockProtection/ folder into your wiki's extensions/ directory.
2. Add to the bottom of LocalSettings.php:

wfLoadExtension( 'IpBlockProtection' );

// Required
$wgIpBlockEnabled = true;
$wgIpBlockSiteId  = 'your-site-id';
$wgIpBlockApiKey  = 'your-api-key';

// Optional (defaults shown)
$wgIpBlockApiUrl       = 'https://api.ip-block.com/v1/check';
$wgIpBlockFailOpen     = true;                 // allow on API failure
$wgIpBlockCacheTtl     = 300;                  // seconds; 0 = every request
$wgIpBlockBehindProxy  = false;                // true behind Cloudflare/proxy
$wgIpBlockBlockAction  = 'redirect';           // 'redirect' or 'message'
$wgIpBlockBlockMessage = 'Access to this wiki has been denied.';
$wgIpBlockWhitelist    = [ '203.0.113.10' ];   // always allowed

3. Confirm it is loaded on Special:Version.

Configuration ($wg settings)

Setting	Default	Notes
$wgIpBlockEnabled	false	Master switch
$wgIpBlockSiteId	''	Your ip-block.com site id
$wgIpBlockApiKey	''	Sent in the request body
$wgIpBlockApiUrl	https://api.ip-block.com/v1/check
$wgIpBlockFailOpen	true	Allow visitors when the API is unreachable
$wgIpBlockCacheTtl	300	Seconds; 0 = check every request
$wgIpBlockBehindProxy	false	Read real IP from CF / XFF headers
$wgIpBlockBlockAction	redirect	redirect or message (HTTP 403)
$wgIpBlockBlockMessage	(text)	Used with the message action
$wgIpBlockWhitelist	[]	Array of always-allowed IPs

License

GNU General Public License v2.0 only.