diff --git a/bookwyrm/tests/views/test_federation.py b/bookwyrm/tests/views/test_federation.py
index 4dc5d048f..b56c2581e 100644
--- a/bookwyrm/tests/views/test_federation.py
+++ b/bookwyrm/tests/views/test_federation.py
@@ -1,5 +1,7 @@
 """ test for app action functionality """
+import json
 from unittest.mock import patch
+from django.core.files.uploadedfile import SimpleUploadedFile
 from django.template.response import TemplateResponse
 from django.test import TestCase
 from django.test.client import RequestFactory
@@ -127,3 +129,38 @@ class FederationViews(TestCase):
         self.assertEqual(server.server_name, "remote.server")
         self.assertEqual(server.application_type, "coolsoft")
         self.assertEqual(server.status, "blocked")
+
+    def test_import_blocklist(self):
+        """ load a json file with a list of servers to block """
+        server = models.FederatedServer.objects.create(server_name="hi.there.com")
+        self.remote_user.federated_server = server
+        self.remote_user.save()
+
+        data = [
+            {"instance": "server.name", "url": "https://explanation.url"},  # new server
+            {"instance": "hi.there.com", "url": "https://explanation.url"},  # existing
+            {"a": "b"},  # invalid
+        ]
+        json.dump(data, open("file.json", "w"))
+
+        view = views.ImportServerBlocklist.as_view()
+        request = self.factory.post(
+            "", {
+                "json_file": SimpleUploadedFile(
+                    "file.json", open("file.json", "rb").read()
+                )
+            }
+        )
+        request.user = self.local_user
+        request.user.is_superuser = True
+
+        view(request)
+        server.refresh_from_db()
+        self.remote_user.refresh_from_db()
+
+        self.assertEqual(models.FederatedServer.objects.count(), 2)
+        self.assertEqual(server.status, "blocked")
+        self.assertFalse(self.remote_user.is_active)
+        created = models.FederatedServer.objects.get(server_name="server.name")
+        self.assertEqual(created.status, "blocked")
+        self.assertEqual(created.notes, "https://explanation.url")
diff --git a/bookwyrm/views/federation.py b/bookwyrm/views/federation.py
index b9a7fa854..25cd212b3 100644
--- a/bookwyrm/views/federation.py
+++ b/bookwyrm/views/federation.py
@@ -65,6 +65,11 @@ class AddFederatedServer(View):
         return redirect("settings-federated-server", server.id)
 
 
+@method_decorator(login_required, name="dispatch")
+@method_decorator(
+    permission_required("bookwyrm.control_federation", raise_exception=True),
+    name="dispatch",
+)
 class ImportServerBlocklist(View):
     """ manually add a server """