This is a brother issue to #1169 and a counter-issue to #1394 (where we discuss documenting that it is not possible to ban an IP in Backdrop and that such a feature belongs in contrib).

Both D8 and D7 have a ban IP feature (, so this makes this issue here also part of #378:

In D7 it is part of the system module, so enabled by default:


...whereas in D8 it is a separate core module (Ban) that is disabled by default:

screen shot 2018-07-07 at 4 55 48 pm

Related issue and change record where the "Ban IP" feature was removed from Backdrop core: #2543

I personally get a lot of "page not found" errors in the log of quite a few sites I run. Some examples of pages requested are:


...and so on. So, it would be great to have an automatic thing in place that works like fail2ban and blocks "nasties" (with the threshold being configurable). For feature parity with Drupal, we should also allow manual entry of IP addresses.

If we have this + Honeypot in core (#1169) and enabled with some sensible defaults out of the box + a dedicated Configuration -> Security admin section, then we'd be able to market all that as additional security features.

GitHub Issue #: