Plugin Directory

IP Geo Block

It blocks any spams, login attempts and malicious access to the admin area posted from outside your nation, and also prevents zero-day exploit.

  • Bug fix: Fixed the issue that the Blacklist did not work properly. Thanks to TJayYay for reporting this issue at support forum.


  • Enhancement: Enforce preventing self blocking at the first installation. And add the scan button to get all the country code using selected API. Thanks to Nils for a nice idea at support forum.
  • New feature: Add pie chart to display statistics of "Blocked by country".
  • Enhancement: WP-ZEP is reinforced against CSRF.
  • Bug fix: Fix illegal handling of the fragment in a link.
  • See details at 2.1.5 release note.


  • Bug fix: Fix the issue that this plugin broke functionality of a certain plugin. Thanks to opsec for reporting this issue at support forum.
  • Improvement: Add checking process for validation rule to prevent being blocked itself. Thanks to internationals for proposing at support forum
  • Improvement: Arrage the order of setting sections to focus the goal of this plugin.
  • See details at 2.1.4 release note.


  • New feature: Add "show" / "hide" at each section on the "Settings" tab.
  • New feature: Add an emergency function that invalidate blocking behavior in case yourself is locked out. This feature is commented out by default at the bottom of ip-geo-block.php.
  • Improvement: Prevent adding query strings to the static resources when users logged in.
  • Improvement: Improved the compatibility with Autoptimize.
  • Bug fix: Fix the issue related to showing featured themes on dashboard.
  • Bug fix: Fix minor bug in rewrite.php for the advanced use case.
  • See details at 2.1.3 release note.


This is a maintenance release.

  • Bug fix: Fix the issue that the login-fail-counter didn't work when the validation at Login form was block by country (register, lost password). In this release, the login-fail-counter works correctly.
  • Bug fix: Fix the issue that the validation settings of Admin area and Admin ajax/post were influential with each other. Now each of those works individually.
  • Bug fix: "Site Stats" of Jetpack is now shown on the admin bar which issue was reported on support forum.
  • Improvement: Hide checking the existence of log db behind the symbol IP_GEO_BLOCK_DEBUG to reduce 1 query on admin screen.
  • Improvement: Add alternative functions of BCMath extension to avoid PHP Fatal error: Call to undefined function in IP2Location.php when IPv6 is specified.
  • Improvement: Use MaxMind database at the activating process not to be locked out by means of inconsistency of database at the activation and after.
  • See more details at 2.1.2 release note.


  • New feature: Added Block by country (register, lost password) at Login form on Settings tab in order to accept the registered users as membership from anywhere but block the request of new user ragistration and lost password by the country code. Is't suitable for BuddyPress and bbPress.
  • Improvement: Added showing the custom error page for http response code 4xx and 5xx. For example the 403.php in the theme template directory or in the child theme directory is used if it exists. And new filter hooks ip-geo-block-(comment|xmlrpc|login|admin)-(status|reason) are available to customize the response code and reason for human.
  • Obsoleted: Obsoleted the filter hooks ip-geo-block-(admin-actions|admin-pages|wp-content). Alternatively new filter hooks ip-geo-block-bypass-(admins|plugins|themes) are added to bypass WP-ZEP.
  • Find out more details in the 2.1.1 release note.


  • New feature: Expanded the operating range of ZP-ZEP, that includes admin area, plugins area, themes area. Now it can prevent a direct malicios attack to the file in plugins and themes area. Please go to the "Validation Settings" on "Settings" tab and check it. Also check my article in "Analysis of Attack Vector against WP Plugins".
  • Bug fix: Fixed the issue that action hook ip-geo-block-backup-dir did not work correctly because the order of argument was mismatched.
  • Bug fix: Fixed the issue that a record including utf8 4 bytes character in its columns was not logged into DB in WordPress 4.2.
  • Improvement: Fixed the issue that Referrer Suppressor do nothing with a new element which is added into DOM after DOM ready. The event handler is now delegated at the body.


  • Fixed an issue that a certain type of attack vector to the admin area ( example ) could not be blocked by the reason that some plugins accept it on earlier hook (ie init) than this plugin (previously admin_init).
  • Added re-creating DB table for validation logs in case of accidentally failed at activation process.
  • The time of day is shown with local time by adding GMT offset based on the time zone setting.
  • Optimized resource loading and settings to avoid redundancy.
  • See details at this plugin's blog.


  • Avoid JavaScript error which occurs if an anchor link has no href.
  • Improved UI on admin screen.
  • Added a diagnosis for creation of database table.


  • Sorry for urgent update but avoid an javascript error.


  • Sorry for frequent update but added a function of showing admin notice when none of the IP geolocation providers is selected. Because the user will be locked out from admin screen when the cache expires.
  • Bug fix: Fixed an issue of get_geolocation() method at a time of when the cache of IP address is cleared.
  • Referrer suppressor now supports meta referrer


  • Bug fix: Fixed an issue that empty black list doesn't work correctly when matching rule is black list.
  • New feature: Added 'Zero-day Exploit Prevention for wp-admin'. Because it is an experimental feature, please open a new issue at support forum if you have any troubles with it.
  • New feature: Referrer suppressor for external link. When you click an external hyperlink on admin screen, http referrer will be suppressed to hide a footprint of your site.
  • Also added the filter hook ip-geo-block-admin-actions for safe actions on back-end.


  • New feature: Include wp-admin/admin-post.php as a validation target in the Admin area. This feature is to protect against a vulnerability such as Analysis of the Fancybox-For-WordPress Vulnerability on Sucuri Blog.
  • Added a sample code snippet as a use case for 'Give ajax permission in case of safe actions on front facing page'. See Example 10 in sample.php.


  • Fixed the issue of improper scheme from the HTTPS site when loading js for google map.
  • In order to prevent accidental disclosure of the length of password, changed the length of * (masked password) which is logged into the database.


  • New feature: Protection against brute-force and reverse-brute-force attacks to wp-login.php, xmlrpc.php and admin area. This is an experimental function and can be enabled on Settings tab. Malicious access can try to login only 5 times per IP address. This retry counter can be reset to zero by Clear statistics on Statistics tab.


  • New feature: Added a new class for recording the validation logs to analyze posting pattern.
  • Fixed an issue of not being set the own country code at first installation.
  • Fixed an error which occurs when ip address is unknown.


  • New feature: Added validation of trackback spam.
  • Added $_SERVER keys for extra IPs into options to validate additional IP addresses.
  • Removed some redundant codes and corrected all PHP notices and warnings which had been suppressed by WordPress.


  • New feature: Added validation of pingback.ping through xmlrpc.php and new option to validate all the IP addresses in HTTP_X_FORWARDED_FOR.
  • Fixed an issue: Maxmind database file may be downloaded automatically without deactivate/re-activate when upgrade is finished.
  • This is the final version on 1.x. On next release, accesses to login.php and admin area will be also validated for security purpose.


  • Fixed an issue: Option table will be updated automatically without deactivate/re-activate when this plugin is upgraded.
  • A little bit performance improvement: Less memory footprint at the time of downloading Maxmind database file. Less sql queries when Save statistics is enabled.


  • New feature: Added Maxmind GeoLite database auto downloader and updater.
  • The filter hook ip-geo-block-validate was discontinued. Instead of it, the new filter hook ip-geo-block-comment is introduced.
  • Performance improvement: IP address is verified at an earlier stage than before.
  • Others: Fix a bug of handling cache, update status of some REST APIs.


  • Fixed issue of default country code. When activating this plugin for the first time, get the country code from admin's IP address and set it into white list.
  • Add number of calls in cache of IP address.


  • Implement the cache mechanism to reduce load on the server.
  • Better handling of errors on the search tab so as to facilitate the analysis of the service problems.
  • Fixed a bug of setting user agent strings in 1.0.2. Now the user agent strings (WordPress/3.9.2; http://example.com/) becomes to its own (WordPress/3.9.2; ip-geo-block 1.1.0).


  • Temporarily stop setting user agent strings to supress a bug in 1.0.2.


  • Update provider settings. Smart-IP.net was terminated, ipinfo.io is now available for IPv6.
  • Set the own user agent strings for WP_Http.


  • Modify Plugin URL.
  • Add apply_filters() to be able to change headers.


  • Ready to release.

Requires: 3.7 or higher
Compatible up to: 4.3.1
Last Updated: 2015-10-7
Active Installs: 3,000+


4 out of 5 stars


5 of 6 support threads in the last two months have been resolved.

Got something to say? Need help?


Not enough data

0 people say it works.
0 people say it's broken.