Plugin Directory

Test out the new Plugin Directory and let us know what you think.

IP Geo Block

It blocks spam posts, login attempts and malicious access to the back-end requested from the specific countries, and also prevents zero-day exploit.

  • Bug fix: Fix the blocking issue in some environments when upgrading from to 3.0.0.
  • Bug fix: Fix the blocking issue at opening a new window via context menu on dashboard.
  • Bug fix: Fix the potential issue of 500 Internal error in cron job.
  • Improvement: Revive 410 Gone for response code.
  • Improvement: Prevent the issue of resetting matching rule and country code at upgrading.

  • Bug fix: Fix the issue where Login form could not be disabled on Back-end target settings.
  • Bug fix: Fix the issue where trackback and pingback could not be blocked since 2.2.4.
  • Improved: Apply the action hook 'pre_trackback_post' that was introduced in WP 4.7.0.
  • Improved: Use 'safe_redirect()' instead of 'redirect()' for secured internal redirection. If you set an external url for Redirect URL, please use the filter hook 'allowed_redirect_hosts'.
  • Improved: Better compatibility with the plugin "Anti-Malware Security and Brute-Force Firewall".


  • Bug fix: Add lock mechanism for local geolocation DBs to avoid potential fatal error.
  • Improvement: Add self blocking prevention potentially caused by login attempts with the same IP address of logged in user.
  • New feature: Add "Installation information" button to make it easy to submit an issue at support forum.


  • New feature: Add the function of blocking on front-end.
  • New filter hook: Add ip-geo-block-public to extend validation on front-end.
  • Improvement: Avoid conflict with "Open external links in a new window" plugin and some other reason to prevent duplicated window open. For more detail, see this discussion at support forum.
  • Improvement: Better compatibility with some plugins, themes and widgets.
  • Improvement: Deferred execution of SQL command to improve the response.
  • Improvement: Make the response compatible with WP original when it is requested by GET method.
  • See some details at release 3.0.0.

  • Bug fix: Blocking Wordfence scanning. (@)
  • Bug fix: Illegal elimination of colon in text field for IP address. (@)
  • Improved: Compatibility with PHP 7 that cause to feel relaxed. (@)
  • Improved: Avoid resetting whitelist on update by InfiniteWP. (@)
  • Trial feature: X-Robots-Tag HTTP header with noindex, nofollow for login page. (@)


  • New feature: A new option that makes this plugin configured as a "Must-use plugin". It can massively reduce the server load especially against brute-force attacks because it initiates this plugin prior to other typical plugins.
  • Improvement: Validation of a certain signature against XSS is internally added to "Bad signature in query" by default.
  • Improvement: Improved compatibility with PHP 7 (Thanks to FireMyst.
  • Find details in 2.2.9 Release Note.

  • Bug fix: Fixed the mismatched internal version number.

  • Bug fix: Fixed the issue of undefined function wp_get_raw_referer() error that happened under certain condition. See the issue at forum.
  • Improved: Avoid resetting country code on update. See the issue at forum.


  • Bug fix: Fixed the issue of stripping some required characters for Google maps API key.
  • New feature: Whois database Lookup for IP address on search tab.
  • Update: Updated geolocation API libraries and services.
  • Find more details in 2.2.8 Release Note.


  • Bug fix: Fix inadequate validation of "Bad signatures in query".
  • Improvement: Add fallback for Google Maps API key (@) and corruption of "Bad signatures" (@).
  • Update: Update geolocation service api.
  • Find details about Google Maps API in 2.2.7 Release Note.


  • New feature: Add saving csv file of logs in "Logs" tab.
  • New feature: Add filter hook ip-geo-block-record-log to control over the conditions of recording in more detail.
  • Bug fix: Fixed the issue that "Exceptions" for Plugins/Themes area does not work properly. Please confirm your settings again.
  • See details at release 2.2.6.


  • New feature: On the settings page, you can specify the pliugin or theme which would cause undesired blocking in order to exclude it from the validation target without embedding any codes into functions.php.
  • Improvement: Optimize resource loading on admin dashboard.
  • Improvement: Support clean uninstall for network / multisite.
  • Improvement: Improve the compatibility of downloading IP address databases for Microsoft IIS.
  • Bug fix: Support FORCE_SSL_ADMIN.
  • Bug fix: Fix the issue of @ and change the option name "Important files" to "Bad signatures in query" to avoid misuse.
  • Bug fix: Fix the issue of @ which might be caused by some race condition.
  • Bug fix: Fix the issue of restoring post revisions which was blocked.

Sorry for frequent updating.

  • Bug fix: Fixed the issue of Warning: strpos(): Empty needle in... that was reported in @ and @.


  • Bug fix: Fixed the issue that some links on network admin of multisite were blocked when WP-ZEP for admin area or admin ajax/post was enabled.
  • New feature: Added configure of .htaccess for the plugins/themes area.
  • Enhancement: Added wp-signup.php to the list of validation target.
  • Enhancement: Added exporting and importing the setting parameters.
  • Improvement: Made the logout url compatible with Rename wp-login.php.
  • Improvement: Made condition of validation more strictly at admin diagnosis to prevent unnecessary notice of self blocking. (@)
  • Improvement: Improved some of UI. (@, @)
  • See some details at release 2.2.4.

  • Bug fix: Fixed the issue that disabled validation target was still blocked by country. (@)
  • Improvement: Better handling of charset and errors for MySQL. (@)


  • Improvement: Since WordPress 4.4, XML-RPC system.multicall is disabled when the authentication fails, but still processed all the methods to the end. Now this plugin immediately blocks the request when the authentication fails without processing the rest of the methods.
  • Improvement: Add UI to change the maximum number of login attempts.
  • Improvement: Add a fallback process of setting up the directory where the geo location database APIs should be installed. It will be set as wp-content/uploads/ instead of wp-content/plugins/ip-geo-block/ or wp-content/ in case of being unable to obtain proper permission. (@, @)
  • Improvement: Moderate the conditions of redirection after logout. (@)
  • Improvement: Prevent self blocking caused by irrelevant signature. (@)
  • Bug fix: Fixed the issue of conflicting with certain plugins due to the irrelevant handling of js event. (@)
  • New feature: Add "Blocked per day" graph for the daily statistics.
  • See some details at 2.2.3 release note.

Sorry for frequent update again but the following obvious bugs should be fixed.

  • Bug fix: Fixed the issue of not initializing country code at activation.
  • Bug fix: Fixed the issue that scheme less notation like '//example.com' could not be handled correctly.

Sorry for frequent update.

  • Bug fix: Fixed the issue of race condition at activation. This fix is related to the urgent security update at which was not actually the security issue but a bug. See this thread about little more details.
  • Improvement: Improved the compatibility with Jetpack.

  • Urgent security update: Killed the possibility of the options being altered.


  • Enhancement: Refactored some codes and components. The number of attacks that can be proccessed per second has been improved by 25% at the maximum.
  • Improvement: In the previous version, the statistical data was recorded into wp_options. It caused the uncertainty of recording especially in case of burst attacks. Now the data will be recorded in an independent table to improve this issue.
  • Bug fix: Fixed conflict with NextGEN Gallary Pro. Thanks to bodowewer.
  • Bug fix: Fixed some filter hooks that did not work as intended.
  • See more details at 2.2.2 release note.

  • Bug fix: Fixed "open_basedir restriction" issue caused by file_exists().


  • Enhancement: In previous version, local geolocation databases will always be removed and downloaded again at every upgrading. Now, the class library for Maxmind and IP2Location have become independent of this plugin and you can put them outside this plugin in order to cut the above useless process. The library can be available from WordPress-IP-Geo-API.
  • Deprecated: Cooperation with IP2Location plugins such as IP2Location Tags, IP2Location Variables, IP2Location Country Blocker is out of use. Instead of it, free IP2Location LITE databases for IPv4 and IPv6 will be downloaded.
  • Improvement: Improved connectivity with Jetpack.
  • Improvement: Improved immediacy of downloading databases at upgrading.
  • Improvement: Replaced a terminated RESTful API service with a new stuff.
  • Bug fix: Fixed issue that clicking a link tag without href always refreshed the page. Thanks to wyclef.
  • Bug fix: Fixed issue that deactivating and activating repeatedly caused to show the welcome message.
  • Bug fix: Fixed issue that a misaligned argument in the function caused 500 internal server error when a request to the php files in plugins/themes area was rewrited to rewrite.php.

Sorry for frequent update.

  • Fix: Fixed the issue that some actions of other plugins were blocked.


  • Important: Now Block by country and Prevent Zero-day Exploit become to work independently on Admin area, Admin ajax/post at Validation target settings. Please reconfirm them.
  • Important: Previously, a request whose country code can't be available was always blocked. But from this release, such a request is considered as comming from the country whose code is ZZ. It means that you can put ZZ into the white list and black list.
  • New feature: White list and Black list of extra IP addresses prior to the validation of country code. Thanks to Fabiano for good suggestions at support forum
  • New feature: Malicious signatures to prevent disclosing the important files via vulnerable plugins or themes. A malicious request to try to expose wp-config.php or passwd can be blocked.
  • New feature: Add privacy considerations related to IP address. Add Anonymize IP address at Record settings.
  • Bug fix: Fix the issue that spaces in Text message on comment form are deleted.
  • See details at 2.2.0 release note.

  • Bug fix: Fixed the issue that the Blacklist did not work properly. Thanks to TJayYay for reporting this issue at support forum.


  • Enhancement: Enforce preventing self blocking at the first installation. And add the scan button to get all the country code using selected API. Thanks to Nils for a nice idea at support forum.
  • New feature: Add pie chart to display statistics of "Blocked by country".
  • Enhancement: WP-ZEP is reinforced against CSRF.
  • Bug fix: Fix illegal handling of the fragment in a link.
  • See details at 2.1.5 release note.


  • Bug fix: Fix the issue that this plugin broke functionality of a certain plugin. Thanks to opsec for reporting this issue at support forum.
  • Improvement: Add checking process for validation rule to prevent being blocked itself. Thanks to internationals for proposing at support forum
  • Improvement: Arrage the order of setting sections to focus the goal of this plugin.
  • See details at 2.1.4 release note.


  • New feature: Add "show" / "hide" at each section on the "Settings" tab.
  • New feature: Add an emergency function that invalidate blocking behavior in case yourself is locked out. This feature is commented out by default at the bottom of ip-geo-block.php.
  • Improvement: Prevent adding query strings to the static resources when users logged in.
  • Improvement: Improved the compatibility with Autoptimize.
  • Bug fix: Fix the issue related to showing featured themes on dashboard.
  • Bug fix: Fix minor bug in rewrite.php for the advanced use case.
  • See details at 2.1.3 release note.


This is a maintenance release.

  • Bug fix: Fix the issue that the login-fail-counter didn't work when the validation at Login form was block by country (register, lost password). In this release, the login-fail-counter works correctly.
  • Bug fix: Fix the issue that the validation settings of Admin area and Admin ajax/post were influential with each other. Now each of those works individually.
  • Bug fix: "Site Stats" of Jetpack is now shown on the admin bar which issue was reported on support forum.
  • Improvement: Hide checking the existence of log db behind the symbol IP_GEO_BLOCK_DEBUG to reduce 1 query on admin screen.
  • Improvement: Add alternative functions of BCMath extension to avoid PHP Fatal error: Call to undefined function in IP2Location.php when IPv6 is specified.
  • Improvement: Use MaxMind database at the activating process not to be locked out by means of inconsistency of database at the activation and after.
  • See more details at 2.1.2 release note.


  • New feature: Added Block by country (register, lost password) at Login form on Settings tab in order to accept the registered users as membership from anywhere but block the request of new user ragistration and lost password by the country code. Is't suitable for BuddyPress and bbPress.
  • Improvement: Added showing the custom error page for http response code 4xx and 5xx. For example the 403.php in the theme template directory or in the child theme directory is used if it exists. And new filter hooks ip-geo-block-(comment|xmlrpc|login|admin)-(status|reason) are available to customize the response code and reason for human.
  • Obsoleted: Obsoleted the filter hooks ip-geo-block-(admin-actions|admin-pages|wp-content). Alternatively new filter hooks ip-geo-block-bypass-(admins|plugins|themes) are added to bypass WP-ZEP.
  • Find out more details in the 2.1.1 release note.


  • New feature: Expanded the operating range of ZP-ZEP, that includes admin area, plugins area, themes area. Now it can prevent a direct malicios attack to the file in plugins and themes area. Please go to the "Validation Settings" on "Settings" tab and check it. Also check my article in "Analysis of Attack Vector against WP Plugins".
  • Bug fix: Fixed the issue that action hook ip-geo-block-backup-dir did not work correctly because the order of argument was mismatched.
  • Bug fix: Fixed the issue that a record including utf8 4 bytes character in its columns was not logged into DB in WordPress 4.2.
  • Improvement: Fixed the issue that Referrer Suppressor do nothing with a new element which is added into DOM after DOM ready. The event handler is now delegated at the body.


  • Fixed an issue that a certain type of attack vector to the admin area ( example ) could not be blocked by the reason that some plugins accept it on earlier hook (ie init) than this plugin (previously admin_init).
  • Added re-creating DB table for validation logs in case of accidentally failed at activation process.
  • The time of day is shown with local time by adding GMT offset based on the time zone setting.
  • Optimized resource loading and settings to avoid redundancy.
  • See details at this plugin's blog.


  • Avoid JavaScript error which occurs if an anchor link has no href.
  • Improved UI on admin screen.
  • Added a diagnosis for creation of database table.


  • Sorry for urgent update but avoid an javascript error.


  • Sorry for frequent update but added a function of showing admin notice when none of the IP geolocation providers is selected. Because the user will be locked out from admin screen when the cache expires.
  • Bug fix: Fixed an issue of get_geolocation() method at a time of when the cache of IP address is cleared.
  • Referrer suppressor now supports meta referrer


  • Bug fix: Fixed an issue that empty black list doesn't work correctly when matching rule is black list.
  • New feature: Added 'Zero-day Exploit Prevention for wp-admin'. Because it is an experimental feature, please open a new issue at support forum if you have any troubles with it.
  • New feature: Referrer suppressor for external link. When you click an external hyperlink on admin screen, http referrer will be suppressed to hide a footprint of your site.
  • Also added the filter hook ip-geo-block-admin-actions for safe actions on back-end.


  • New feature: Include wp-admin/admin-post.php as a validation target in the Admin area. This feature is to protect against a vulnerability such as Analysis of the Fancybox-For-WordPress Vulnerability on Sucuri Blog.
  • Added a sample code snippet as a use case for 'Give ajax permission in case of safe actions on front facing page'. See Example 10 in sample.php.


  • Fixed the issue of improper scheme from the HTTPS site when loading js for google map.
  • In order to prevent accidental disclosure of the length of password, changed the length of * (masked password) which is logged into the database.


  • New feature: Protection against brute-force and reverse-brute-force attacks to wp-login.php, xmlrpc.php and admin area. This is an experimental function and can be enabled on Settings tab. Malicious access can try to login only 5 times per IP address. This retry counter can be reset to zero by Clear statistics on Statistics tab.


  • Ready to release.

Requires: 3.7 or higher
Compatible up to: 4.7.2
Last Updated: 2 days ago
Active Installs: 10,000+


4.9 out of 5 stars


25 of 29 support threads in the last two months have been marked resolved.

Got something to say? Need help?


Not enough data

1 person says it works.
0 people say it's broken.

50,2,1 100,1,1
100,1,1 0,2,0
100,1,1 100,3,3
0,1,0 100,1,1
100,1,1 100,1,1