On client sites, \u201cblock visitors from these countries\u201d sounds simple \u2014 until you look at how most tools do it. Many geolocation plugins phone home on every request, or they lean on a third-party lookup API. That means extra latency, another service in the critical path, and a privacy story that is harder to explain to a client.<\/p>\n\n
We also saw the other failure mode: the rule looks correct in settings, but a full-page cache (LiteSpeed, WP Rocket, Cloudflare HTML cache, host caching) keeps serving a previously allowed page to someone who should be blocked \u2014 or the reverse.<\/p>\n\n
Country access control has to be local-first. The decision for a visitor should happen on your<\/em> server, against data you control, without a round trip to an external API on every page view.<\/p>\n\n And because the response depends on who<\/em> is visiting, page caching cannot treat every visitor as if they got the same HTML. If your cache layer ignores that, geo rules will look broken even when the plugin logic is fine.<\/p>\n\n Country Access Control (the product we also call Geo Lockdown) is our answer for WordPress shops that need country allow\/block rules without shipping visitor IPs to a lookup API at runtime.<\/p>\n\n Lookups run against IP range data stored in your site\u2019s MySQL\/MariaDB tables. You choose when to refresh that data. Admin, login, and common WordPress endpoints stay reachable so you do not lock yourself out while testing.<\/p>\n\n 1. Download a full GeoIP database before you trust the results<\/strong><\/p>\n\n The plugin ships with a small starter dataset so it activates cleanly. That is enough to explore settings \u2014 not enough for production accuracy. Use Download Latest Database<\/strong> under the GeoIP Database panel. Nothing about your site or visitors is sent; only the public CSV file is fetched when an administrator clicks the button.<\/p>\n\n 2. Page caching and CDNs<\/strong><\/p>\n\n When Country Access Control is enabled, the plugin marks front-end responses as non-cacheable for common cache plugins (including LiteSpeed Cache, WP Rocket, and WP Super Cache style APIs) and purges those caches when you save settings.<\/p>\n\n That still does not cover every stack. If your host, CDN, or another plugin caches full HTML at the edge, you can get stale allow\/block decisions until that cache is cleared or told not to cache HTML for the public site.<\/p>\n\n After you enable the plugin or change countries \/ response settings:<\/p>\n\n If rules still look wrong after a purge, open Diagnostics, run a Test IP, and confirm the detected IP \/ country before digging into theme or security-plugin conflicts.<\/p>\n\n 3. Proxies, Cloudflare, and real visitor IPs<\/strong><\/p>\n\n If the site sits behind Cloudflare or another reverse proxy, enable Cloudflare support and\/or configure trusted proxies and the correct connecting-IP header. Otherwise the plugin may see the proxy IP instead of the visitor, and country decisions will be wrong.<\/p>\n\n 4. Do not test blocks while logged in as an administrator<\/strong><\/p>\n\n Administrator bypass is on by default (and wp-admin \/ wp-login are always bypassed). Turn administrator bypass off only while testing, and use a private window while logged out.<\/p>\n\n 5. Honest limitation<\/strong><\/p>\n\n This is IP-to-country mapping, not a GPS check. VPNs, proxies, Tor, and similar tools can present an IP from another country. No IP-only system can guarantee a person\u2019s physical location.<\/p>\n\n This plugin can optionally connect to one external service, DB-IP<\/strong> (db-ip.com), solely to let you download an updated GeoIP dataset.<\/p>\n\n What it is and what it's used for:<\/strong> DB-IP publishes a free, monthly-updated \"IP to Country Lite\" CSV database under a Creative Commons Attribution 4.0 license. When you click Download Latest Database<\/strong> under Settings \u2192 Country Access Control<\/strong>, the plugin fetches that public CSV.GZ file directly from What data is sent:<\/strong> Nothing about your site, its visitors, or their IP addresses is sent to DB-IP. The request is a plain HTTP GET for a public, static file; no query parameters, cookies, or identifying data are included.<\/p>\n\n When it's used:<\/strong> Only when an administrator manually clicks \"Download Latest Database.\" It never runs automatically, on a schedule, or in the background.<\/p>\n\n Service links: db-ip.com<\/a> \u00b7 Free Lite database & license terms<\/a><\/p>\n\n\n No. Country lookups run against your local MySQL\/MariaDB data. The only documented external connection is the optional, administrator-triggered DB-IP database download.<\/p><\/dd>\n It can, if a full-page or CDN cache serves the same HTML to every visitor. The plugin asks common WordPress cache plugins not to store those responses and purges them when settings change \u2014 but you should still purge host\/CDN caches after enabling or changing rules. See \u201cThings to take care of\u201d above.<\/p><\/dd>\n No. GeoIP data is stored in MySQL\/MariaDB tables, which every WordPress site already uses.<\/p><\/dd>\n Yes. Click Download Latest Database<\/strong> under Settings \u2192 Country Access Control<\/strong> to fetch the current free DB-IP Country Lite CSV.<\/p><\/dd>\n No. wp-admin and wp-login.php are always bypassed. Logged-in administrators can also bypass restrictions by default.<\/p><\/dd>\n Not when Allow verified Googlebot<\/strong> is enabled (default). Crawlers are verified by reverse DNS hostname and forward confirmation back to the same IP. A spoofed Googlebot User-Agent alone does not bypass the geo block.<\/p><\/dd>\n Yes. Trusted proxy\/CDN headers can be configured, and Cloudflare source ranges are validated before those headers are trusted.<\/p><\/dd>\n\n<\/dl>\n\n\nWhy we built this<\/h4>\n\n
What you get<\/h4>\n\n
\n
How to use it<\/h4>\n\n
\n
Things to take care of (please read this)<\/h4>\n\n
\n
External services<\/h3>\n\n
https:\/\/download.db-ip.com\/<\/code> and imports it into your site's own database. Country lookups for your visitors always run locally afterward \u2014 DB-IP is never contacted while your site is actually enforcing geo-restrictions, only when an administrator explicitly requests a database update.<\/p>\n\n\n
codecaste-country-access-control<\/code> folder to \/wp-content\/plugins\/<\/code><\/li>\n\n
Does this plugin call an external API for every visitor?<\/h3><\/dt>\n
Will page caching break country blocking?<\/h3><\/dt>\n
Does this require the PHP SQLite extension?<\/h3><\/dt>\n
Can I update the IP database?<\/h3><\/dt>\n
Will I lock myself out of wp-admin?<\/h3><\/dt>\n
Will Googlebot be blocked outside the allowed countries?<\/h3><\/dt>\n
Does it support Cloudflare or reverse proxies?<\/h3><\/dt>\n
1.0.1<\/h4>\n\n
\n
1.0.0<\/h4>\n\n
\n