Skip to content

Firewall

Country blocking

Pro and AgencyAbout Firewall

Blocks visitors from the countries you choose, or allows only the countries you choose, using a country database stored on your own server.

What it does

Blocklist mode turns away visitors from the countries you list. Allowlist mode turns away everyone except the countries you list.

You choose what blocked visitors get: a 403 "forbidden" page with your message, a 404 "not found" page, or a redirect to another address. You also choose what happens when a country cannot be worked out.

Why it matters

If your business only serves a few countries, most attacks from elsewhere can simply be refused. A local shop rarely needs visitors from the other side of the world.

Set it up

  1. Add your own address to the IP allow list first, in case you travel.
  2. Go to the Firewall tab, section Geo blocking, and switch on Geo IP Blocking.
  3. Check the detection read-out says a country source is available. Stack Guard downloads a free country database for you; behind Cloudflare it can also use Cloudflare's country.
  4. Choose Blocking Mode, pick the countries, and set Unknown Location. Allow is safer to start.
  5. Choose the Response Code and message, then click Save Changes.

Good to know

Country data is never perfect, and VPNs let people appear to be anywhere. Treat country blocking as a filter that cuts noise, not a wall.

Allowlist mode is strict: anyone travelling abroad, including you, is blocked unless their address is on the allow list.

Administrators are not blocked inside the admin area, but country blocking does apply to them on the front of the site.

Visitor addresses are never sent to an outside service: the lookup happens on your server.

Which plan includes it

Country blocking and the country lookup tool are part of Pro.

How it works, for developers
  • Checked on init at priority 2; skipped for AJAX, scheduled tasks and allow-listed addresses.
  • Country lookup order: the CF-IPCountry header (only trusted when the request really comes from Cloudflare), then a MaxMind database at the path you give, then the DB-IP Lite database in uploads/stack-guard/geo/.
  • The DB-IP database is checked daily by the smg_geo_db_update task and downloaded again when older than 32 days. Lookups are cached for an hour in smg_geo_* transients; daily block counts for 30 days in smg_geo_stats.
  • Settings: smg_geo_blocking_enabled, smg_geo_mode, smg_geo_countries, smg_geo_unknown_action, smg_geo_response_code, smg_geo_block_message, smg_geo_redirect_url, smg_geo_maxmind_db_path. Skipped while SMG_SAFE_MODE is defined.

Quick answers about country blocking

What does Country blocking do in Stack Guard?

Blocklist mode turns away visitors from the countries you list. Allowlist mode turns away everyone except the countries you list. You choose what blocked visitors get: a 403 "forbidden" page with your message, a 404 "not found" page, or a redirect to another address. You also choose what happens when a country cannot be worked out.

Why use country blocking on a WordPress site?

If your business only serves a few countries, most attacks from elsewhere can simply be refused. A local shop rarely needs visitors from the other side of the world.

How do I set up country blocking?

1. Add your own address to the IP allow list first, in case you travel. 2. Go to the Firewall tab, section Geo blocking, and switch on Geo IP Blocking. 3. Check the detection read-out says a country source is available. Stack Guard downloads a free country database for you; behind Cloudflare it can also use Cloudflare's country. 4. Choose Blocking Mode, pick the countries, and set Unknown Location. Allow is safer to start. 5. Choose the Response Code and message, then click Save Changes.

Which Stack Guard plan includes country blocking?

Country blocking and the country lookup tool are part of Pro.

More in Firewall

Not running Stack Guard yet? It is free.

Download Free