nodebb-plugin-eu-only

Automatically deletes (or bans) newly registered users whose IP address resolves to a country outside Europe. Designed to combat the wave of fake / spam accounts that originate outside the continent.

How it works

1. A user completes registration.
2. The plugin intercepts NodeBB's filter:register.complete hook.
3. It calls the free ip-api.com geo-IP service (no API key required, limit: 45 req/min).
4. If the resolved country code is not in the European allow-list the account is either deleted or banned (your choice in the ACP), and the client receives an error message.
5. All blocked attempts are stored in NodeBB's database so you can review them in the Admin Control Panel.

Installation

Option A — npm (recommended once published)

cd /path/to/nodebb
npm install nodebb-plugin-eu-only
./nodebb build
./nodebb restart

Option B — manual / development

cd /path/to/nodebb/node_modules
cp -r /path/to/nodebb-plugin-eu-only ./nodebb-plugin-eu-only
cd /path/to/nodebb
./nodebb build
./nodebb restart

Then activate the plugin in ACP → Extend → Plugins.

Configuration

Open ACP → Plugins → EU-Only Filter.

| Setting | Options | Default | Description | |---------|---------|---------|-------------| | Action | delete / ban | delete | What to do with a blocked account. Delete removes it entirely; Ban keeps it for audit. | | Allow localhost / private IPs | checkbox | ✅ | Lets you register from 127.0.0.1 or RFC-1918 addresses (useful during development). | | Log blocked registrations | checkbox | ✅ | Writes info-level log lines to the NodeBB logger for each blocked attempt. |

Covered countries

The plugin ships with a broad list of geographic-Europe country codes:

AD, AL, AT, BA, BE, BG, BY, CH, CY, CZ, DE, DK, EE, ES, FI, FO, FR, GB, GE, GI, GR, HR, HU, IE, IM, IS, IT, LI, LT, LU, LV, MC, MD, ME, MK, MT, NL, NO, PL, PT, RO, RS, RU, SE, SI, SK, SM, TR, UA, VA, XK

This includes EU members, EEA countries, the UK, Switzerland, and other geographically-European states. Edit EUROPEAN_COUNTRY_CODES in lib/index.js to add or remove entries.

Fail-open policy

If the geo-IP lookup fails (network error, timeout, ip-api outage) the plugin allows the registration through. This means a geo-IP service outage will never lock legitimate users out. You can see timeout warnings in the NodeBB log.

Rate limits

ip-api.com's free tier allows 45 requests per minute. For most forums this is more than sufficient. If your forum receives more signups than that, consider:

• Purchasing an ip-api.com pro key and switching the URL in lib/index.js to https://pro.ip-api.com/json/...?key=YOUR_KEY
• Or replacing the lookup function with another provider such as ipinfo.io or MaxMind GeoLite2.

GDPR note

IP addresses are personal data under GDPR. This plugin:

• Only reads the IP already recorded by NodeBB during registration.
• Sends it to ip-api.com (a third-party processor) solely for geo-location.
• Stores uid:ip:countryCode pairs in your own NodeBB database for audit purposes.

Make sure your forum's privacy policy discloses this processing.

License

MIT