Activity and blocking
Blocking
Block IPs and ranges in the app, at Cloudflare or in nginx, what's always protected, and the safelist.
Block an IP or a range from the activity list, an IP's details, or the Blocking page: for 7 days, 30 days or for good. Every block and safelist asks first.
Where blocks are enforced
| Where | How | Set up |
|---|---|---|
| In the app | A plain 403 before the framework handles the request, on the front end and in the control panel | On by default. PORRO_BLOCK_APP=false turns it off. |
| At Cloudflare's edge | Blocked before traffic reaches your server, through one list shared by your sites | Cloudflare |
| In nginx | Turned away before PHP runs | nginx |
Use any together. The app's own check is the one that always works; Cloudflare and nginx save the server the work.
The blocklist and safelist are database tables, so every server of a site shares them. Expired blocks drop off on their own.
The safelist
Addresses that are never blocked or flagged, even if they keep probing: your office, a monitoring service, a partner's servers. A safelisted address inside a blocked range still gets through. Add them on the Blocking page, or in config where they can't be removed from the panel: see Settings.
Always protected
Some addresses have to reach the site, so they can never be blocked. Blocks that overlap them are refused, and removed if a list changes.
| List | Why | Switch off |
|---|---|---|
| Cloudflare | Blocking Cloudflare would block everyone behind it | Can't |
| Laravel Forge | Forge has to reach the server to deploy and manage it | PORRO_PROTECT_FORGE=false |
| Forge health checks | So Forge's checks keep working | PORRO_PROTECT_FORGE=false |
| Search engine crawlers | Google's and Bing's published crawler addresses. A real crawler can look noisy, but blocking it would drop the site from search. Anything only claiming to be a crawler isn't on these lists, so it can still be flagged and blocked. | PORRO_PROTECT_CRAWLERS=false |
| Private and reserved | Your own network, and addresses that can't come from the internet | Can't |
Open each on the Blocking page to see its addresses and where they come from. The lists are fetched at most once a day, and a copy ships with each connector.
What's refused
A block that could take the site down, or that's a mistake, is refused with the reason:
- anything overlapping an always-protected list
- the address you're blocking from
- an address on the safelist (remove it there first)
- ranges wider than a /16 (IPv4) or /48 (IPv6)
- more than 5,000 entries: block a range instead
Safelisting a range that wide asks you to tick Wide range is OK first.
Behind a proxy or load balancer
The connectors use the framework's idea of the visitor's address, which follows its trusted proxy settings: TrustProxies in Laravel, trustedHosts in Craft. Behind Cloudflare nothing is needed: Cloudflare's header is believed only when the request really came from Cloudflare.