Wonderful Geoblocking Countries

Description

Some sites simply do not need worldwide traffic — or keep getting spam registrations and brute-force login attempts from countries they never do business with.

Wonderful Geoblocking Countries lets you block three areas of your site independently, each with its own country list and its own message:

• Site access — the whole public frontend.
• Login — the wp-login.php page.
• Registration — the user registration form.

For every area you pick the mode that fits:

• Block list — block visitors from the selected countries and allow everyone else.
• Allow list — allow only the selected countries and block everyone else (e.g. “only visitors from Austria, Germany and Switzerland may log in”).

Blocked visitors receive an HTTP 403 response with your custom message (basic HTML allowed).

Built-in safety rails:

• Logged-in administrators are never geoblocked, so you cannot lock yourself out of a site you are logged in to.
• The WordPress admin and the login page are never affected by the site access rule — login blocking is its own explicit setting.
• Visitors whose country cannot be determined are never blocked.

Geolocation data: the plugin uses the free IP2Location LITE country database (IPv4 + IPv6). The database is not bundled: you create a free account at lite.ip2location.com, paste your personal download token into the settings, and the plugin downloads the database (a few MB) onto your server. Once installed, it refreshes itself about once a month — an automatic update you can switch off at any time.

Sites behind a CDN or reverse proxy can feed the real visitor IP (or a ready-made country code, e.g. from Cloudflare’s CF-IPCountry header) into the plugin via the wonderful_geoblocking_countries_client_ip and wonderful_geoblocking_countries_pre_country_code filters.

This plugin uses IP2Location LITE data available from https://lite.ip2location.com.

External services

This plugin can download the IP2Location LITE geolocation database from www.ip2location.com. The download only happens when you actively configure it: you enter your personal download token and click the download button (afterwards a monthly scheduled refresh re-downloads the database with the same token). The token you obtained from your lite.ip2location.com account is sent to www.ip2location.com as part of the download request; no data about your visitors is ever transmitted. This service is provided by IP2Location.com: terms of use, privacy policy.

All country lookups for your visitors happen locally on your server against the downloaded database file — visitor IP addresses never leave your site.