Open the access log of almost any small business website and you will find traffic that makes no sense. A plumber in Leeds getting login attempts from five continents. A bakery shop with a hundred "customers" a day in countries it does not deliver to.
That is the pitch for country blocking: if you do not serve a place, why let it in? It is a fair question. The honest answer has two halves. It can help, and it can backfire.
This article explains how to block countries in WordPress, when it makes sense, when it does not, and how to set it up without locking yourself out.
What Country Blocking Is (and What It Is Not)
Country blocking means that, before your site does any work for a visitor, something checks which country the visitor's internet address belongs to. If that country is on your list, the visitor is turned away.
It is a filter. It removes a chunk of traffic you did not want. It does not fix weak passwords, outdated plugins or vulnerable code, and an attacker in an allowed country, or using a VPN, walks straight past it.
Key takeaway: Block countries in WordPress to cut noise, not to be safe. Updates, strong sign-in and backups do the real security work.
When to Block Countries in WordPress (and When Not To)
When It Makes Sense
Country blocking works best when your audience is narrow and well defined:
- A local business that serves one city or country, such as a dentist, a restaurant or a tradesperson.
- A members-only or regional service where users sign up from known places.
- A site under constant noise from a country it has no business with, where bans one address at a time are not keeping up.
- A sign-in page you want to protect more tightly, as an extra layer on top of normal protections.
In these cases the downside is small. A local plumber loses nothing by turning away traffic from the other side of the world, and the access log gets a lot quieter. Our guide on stopping brute force attacks explains why that matters: fewer junk sign-in attempts means less load and fewer alerts to read.
When It Does Not
Be careful with these situations:
- International customers. Any shop, course or service that sells abroad will lose real orders.
- Travelling customers and staff. Someone on holiday, on a work trip or roaming on a foreign mobile network will see your block page.
- VPN users. Many privacy-minded people, and many employees on a company VPN, appear to be somewhere else. They will be blocked or let in at random.
- Search engine crawlers. Google says in its crawler overview that it egresses primarily from IP addresses in the United States. Block that country and you may block the crawler that puts you in search results. The same page says Google may then try other countries, which gives you unpredictable results, not a plan.
- Payment, shipping and monitoring services. Webhooks from payment providers and checks from uptime services come from servers in places you may not expect. Shops should read the payment section of our WooCommerce security checklist first.
- Anyone who thinks it replaces real security. It does not.
If you are in doubt, the usual advice is to start with a smaller step: protect the sign-in page and leave the public site open. A blocked visitor is a customer you may never hear from.
Blocklist or Allowlist
You have two ways to set the list, and the choice changes how much risk you carry.
| Blocklist | Allowlist | |
|---|---|---|
| What it does | Turns away the countries you list | Turns away everyone except the countries you list |
| Good for | Cutting noise from a few known places | Local sites with a clear audience |
| Risk | Easy to miss a country, so some noise gets through | A traveller, an odd network or a crawler is blocked by default |
| Maintenance | Grows as new sources appear | Shrinks to a short, stable list |
A blocklist is the gentler choice: you name the places you are sure about, and everyone else carries on as before. An allowlist is stricter, and for a truly local business it can be very effective. It also means that anyone outside your list, including you on a trip, is locked out unless their address is on a separate allow list.
If you are unsure, begin with a blocklist and review your logs after a few weeks.
How Country Lookups Actually Work
Your visitor does not tell your site where they are. The site only sees an IP address, which is a number that identifies their connection. To turn that into a country, something has to look the number up.
That something is a geolocation database: a large table that maps ranges of IP addresses to countries, built from registry data and a lot of measurement. Some are free and some are commercial. They are regularly updated because address ranges are bought, sold and reassigned all the time.
This has real limits:
- Country level is good, not perfect. Databases are usually right at country level, much worse at city level, and they can be out of date.
- Mobile and company networks can mislead. Traffic may exit from a different country than the person's location.
- VPNs and proxies hide the real place by design.
- Some addresses have no answer. You need to decide what happens when the country is unknown.
- Behind a CDN, the address can be wrong. If your site sits behind Cloudflare or another proxy, your server sees the proxy's address unless it reads the real visitor address from the right header. If that is set up wrongly, you will block or allow the wrong people.
That last point trips up many sites. Stack Guard's real visitor IP setting exists for it and is included in every plan, Free too.
Where to Block: Cloudflare, Server or Plugin
You can block countries at three levels. Each is a trade-off between where the traffic is stopped and how much control you have.
At the CDN or Edge
If you use a service like Cloudflare, you can write a rule that challenges or blocks by country before the request ever reaches your server. This is the most efficient place, because junk traffic does not use your hosting resources at all. The catch is that rules live outside WordPress, so they are easy to forget about, and a mistake there can take the whole site offline. Our page on using Stack Guard with Cloudflare explains how the two fit together.
At the Web Server
Server rules (in Apache, Nginx or your host's control panel) can also block by country, usually with a geolocation module or database. This is fast and independent of WordPress, but it needs server access and some skill, and not every host allows it.
In a Plugin
A plugin works inside WordPress. It is slower than the edge, because the request has already reached your server, but it is far easier to manage. You get a settings screen, the logic travels with the site, and you can read the results next to your other security settings. For most small sites, this is the practical choice.
You can also combine them. Many people block the worst of the noise at the edge and keep a plugin for finer control. If you are still weighing which tool to use for the job, our guide to the best WordPress security plugin helps you compare.
Test It Without Locking Yourself Out
Before you block countries in WordPress for real, plan your way back in. The scariest part of country blocking is turning it on and watching your own site disappear. A few habits make that nearly impossible.
- Allow list your own address first. Add your office, home and any fixed addresses you use to an IP allow list before you switch anything on.
- Know how you will get back in. Keep SFTP or your host's file manager handy. If a rule locks you out, you need a way to switch it off from outside WordPress.
- Start with the gentlest setting. Use a blocklist with one or two countries you are sure about, not an allowlist with a short list.
- Test from outside. Check from a phone on mobile data, or ask a friend abroad to try. A VPN with an exit in a blocked country is the easiest test.
- Check what happens when the country is unknown. Decide if those visitors get in. Allowing them is safer when you are starting out.
- Watch the logs for a week. Look for real customers hitting the block page. If you see any, adjust.
- Write down what you did. Six months from now, you will not remember.
Home internet addresses change, so check that your allow list entry still matches your current address before you travel.
What to Show Blocked Visitors
When someone is blocked, you have three honest choices.
- A 403 "forbidden" page. Clear and honest. Add a short message with a contact address, so a real person who is blocked by mistake can tell you.
- A 404 "not found" page. Pretends the page does not exist. It reveals less to automated tools, but it can confuse a real visitor who is simply in the wrong place.
- A redirect. Sends the visitor somewhere else, such as a page that explains you do not serve their country. Useful if you want to point them to a local partner.
For a business with real customers, a 403 page with a plain message and an email address is usually kinder than a mystery. Bots do not read the message anyway, and a real person does.
Block Countries in WordPress With Stack Guard
Stack Guard includes country blocking in Pro as part of the firewall. It works like this, based on the country blocking documentation:
- You pick a blocklist (turn away the countries you list) or an allowlist (turn away everyone except those countries).
- Blocked visitors get a 403 page with your message, a 404 page or a redirect to an address you choose.
- You choose what happens when a country cannot be worked out. The docs suggest allowing those visitors while you start.
- Pro also includes a country lookup tool alongside the country rules.
- The lookup happens on your own server, with a country database stored there, so visitor addresses are not sent to an outside service. Behind Cloudflare, it can also use Cloudflare's country header, but only when the request really does come from Cloudflare.
- Addresses on your IP allow list are never stopped by country blocking, and administrators are not blocked inside the admin area. Country blocking does still apply to administrators on the front of the site.
Those two behaviours are worth remembering. The allow list is your safety net, and the admin exception is not a licence to skip testing.
The real visitor address setting that makes lookups accurate behind Cloudflare or another proxy is part of Free, so you can get that right before you upgrade. IP bans and the allow list are also in Free. Pro adds the country rules, custom firewall rules, user agent bans and automatic bans for visitors probing for weak spots. Pro costs $95 a year for one site, and there is a 14-day money-back guarantee on a first purchase.
A Sensible Starting Plan
If you are on the fence, here is a low-risk way to try it.
- Set up the real visitor address correctly, and check the detection read-out matches what a "what is my IP" site shows.
- Add your own address and your team's to the allow list.
- Look at your logs and pick the one or two places that send you the most junk and nothing useful.
- Block those with a blocklist and a 403 page that includes a contact address.
- Review after two weeks. Remove anything that caught a real customer.
- Keep doing the basics: updates, strong passwords, two-factor and backups.
Pro tip: If most of your noise is aimed at the sign-in page, protect that first. Moving the login address and limiting attempts often does more than a country list, and it never blocks a customer.
Then fold the setting into your regular WordPress security audit, so a stale rule never blocks a customer for months.
Country blocking is a useful, blunt tool. Use it for the noise you know you can live without, test it like you would a new lock on your own front door, and do not mistake it for the thing keeping you safe.