{"id":396920,"date":"2026-11-04T01:22:01","date_gmt":"2026-11-04T01:22:01","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/hulo-geo-block\/"},"modified":"2026-11-04T01:21:28","modified_gmt":"2026-11-04T01:21:28","slug":"hulo-geo-block","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/hulo-geo-block\/","author":23597126,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"0.1.1","stable_tag":"0.1.1","tested":"7.1.4","requires":"6.5","requires_php":"8.1","requires_plugins":null,"header_name":"HULO Geo-block","header_author":"HULO Global","header_description":"Allow or block visitors by country or region preset on any WordPress site. IP and crawler allowlists, branded block page or redirect, business hours and a maintenance window. With WooCommerce it also refuses checkout for blocked visitors.","assets_banners_color":"6729c9","last_updated":"2026-11-04 01:21:28","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/huloglobal.com\/wordpress-plugins\/geo-block\/","header_author_uri":"https:\/\/huloglobal.com","rating":0,"author_block_rating":0,"active_installs":0,"downloads":43,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"0.1.1":{"tag":"0.1.1","author":"huloglobal","date":"2026-11-04 01:21:28","revision":3782915}},"upgrade_notice":[],"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3783339,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3783339,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3783339,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3783339,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["0.1.1"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"HULO \u2192 Geo-block, Rules tab with region presets and the live summary.","2":"The branded block page.","3":"Business hours and maintenance window.","4":"Settings: country sources, visitor IP headers and crawler exceptions."}},"plugin_section":[],"plugin_tags":[172575,242487,4124,272867,1281],"plugin_category":[49],"plugin_contributors":[290614],"plugin_business_model":[],"class_list":["post-396920","plugin","type-plugin","status-publish","hentry","plugin_tags-country-blocking","plugin_tags-geo-blocking","plugin_tags-geolocation","plugin_tags-ip-allowlist","plugin_tags-maintenance-mode","plugin_category-maps-and-location","plugin_contributors-huloglobal","plugin_committers-huloglobal"],"banners":{"banner":"https:\/\/ps.w.org\/hulo-geo-block\/assets\/banner-772x250.png?rev=3783339","banner_2x":"https:\/\/ps.w.org\/hulo-geo-block\/assets\/banner-1544x500.png?rev=3783339","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/hulo-geo-block\/assets\/icon-128x128.png?rev=3783339","icon_2x":"https:\/\/ps.w.org\/hulo-geo-block\/assets\/icon-256x256.png?rev=3783339","generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p>HULO Geo-block decides, before WordPress runs its main query, whether a visitor may use your site. Allowed visitors are untouched; refused visitors see a branded block page or are redirected.<\/p>\n\n<p>Works on any WordPress site. With WooCommerce it also refuses add-to-cart and checkout (classic checkout and the Checkout block) for blocked visitors, uses WooCommerce's MaxMind geolocation, and with HULO Payments it refuses payments from blocked visitors.<\/p>\n\n<p><strong>Rules<\/strong><\/p>\n\n<ul>\n<li>Region presets: Worldwide, United Kingdom only, European Union, North America and Oceania.<\/li>\n<li>Extra allowed countries and always-blocked countries (for example \"the EU except one country\", or \"worldwide except a few\").<\/li>\n<li>A live, plain-English summary of what the rules do, and a warning before you save rules that would block everyone.<\/li>\n<\/ul>\n\n<p><strong>Never locks you out<\/strong><\/p>\n\n<ul>\n<li>Administrators (and, with WooCommerce, shop managers) are never blocked.<\/li>\n<li>wp-admin, the login page, cron, AJAX, the REST API, XML-RPC, payment-gateway callbacks (<code>wc-api<\/code>), robots.txt and sitemaps are never blocked.<\/li>\n<li>IP allowlist with IPv4 and IPv6 addresses and CIDR ranges, plus a one-click \"Add my IP\".<\/li>\n<\/ul>\n\n<p><strong>SEO-safe<\/strong><\/p>\n\n<ul>\n<li>Well-known search and link-preview crawlers (Googlebot, Bingbot, DuckDuckBot, Applebot, Facebook, LinkedIn, Slack, WhatsApp and more) are let through by default, so a country restriction does not drop your store out of search results. Permissive, custom and off modes are available.<\/li>\n<li>Crawlers may only browse. A User-Agent can be faked, so add-to-cart, checkout and payments are never exempt.<\/li>\n<li>Optional reverse-DNS verification of Googlebot and Bingbot: a visitor claiming to be one is checked against googlebot.com \/ search.msn.com before it is let through.<\/li>\n<li>Block pages send <code>noindex<\/code>; closures (business hours, maintenance) send HTTP 503 with Retry-After so search engines treat them as temporary.<\/li>\n<\/ul>\n\n<p><strong>Business hours and maintenance<\/strong><\/p>\n\n<ul>\n<li>A weekly opening window in any time zone, including overnight windows and daylight saving.<\/li>\n<li>A one-off maintenance window with its own allowed IPs.<\/li>\n<\/ul>\n\n<p><strong>Geolocation without external calls<\/strong><\/p>\n\n<ul>\n<li>Cloudflare <code>CF-IPCountry<\/code> (and <code>cf-region-code<\/code>), Akamai and Fastly country headers, once you tell the plugin the site is behind that CDN. Any visitor can send these headers, so they are honoured only for requests arriving from a trusted proxy: Cloudflare's published ranges (one tick) or the addresses you list (or the <code>HULO_TRUSTED_PROXIES<\/code> constant).<\/li>\n<li>Web-server GeoIP modules (<code>GEOIP_COUNTRY_CODE<\/code>, <code>MM_COUNTRY_CODE<\/code>).<\/li>\n<li>With WooCommerce: its own geolocation, including its MaxMind database integration.<\/li>\n<li>This plugin never calls a geolocation API. If no source is available yet, the settings page says so and visitors with an unknown country are allowed.<\/li>\n<li>A full country list ships with the plugin; with WooCommerce its translated list is used.<\/li>\n<li>Proxy-aware visitor IP: by default only the connecting address is used. Forwarding headers you tick are read only from trusted proxies, and for <code>X-Forwarded-For<\/code> the right-most address that is not one of your proxies is taken.<\/li>\n<\/ul>\n\n<p><strong>WooCommerce and HULO Payments (optional)<\/strong><\/p>\n\n<ul>\n<li>With WooCommerce active, add-to-cart, the classic checkout and the Checkout block (Store API) refuse blocked visitors on the server, whatever a page cache served.<\/li>\n<li>With HULO Payments active, payments from blocked visitors are refused before they are charged.<\/li>\n<\/ul>\n\n<p><strong>Cache-safe<\/strong><\/p>\n\n<ul>\n<li>Only refused responses are changed, and they are sent with <code>no-store<\/code> and <code>DONOTCACHEPAGE<\/code>, so no page cache stores a block page.<\/li>\n<li>Optional page-cache helper: if a full-page cache serves pages without running WordPress, a small script re-checks the visitor against an uncached endpoint.<\/li>\n<\/ul>\n\n<p><strong>Headless storefronts<\/strong><\/p>\n\n<ul>\n<li><code>GET \/wp-json\/hulo-geo-block\/v1\/check<\/code> returns the current visitor's verdict (rate-limited, uncached). A server-side caller can pass the visitor's country signed with a secret.<\/li>\n<\/ul>\n\n<h4>Geo-block Pro<\/h4>\n\n<p>The optional Pro add-on adds 32 more region presets (EEA, Schengen, EFTA, GCC, ASEAN, LATAM, APAC, Commonwealth and more), rules for 249 states, provinces and regions in 11 countries, a soft block that lets visitors browse with a notice but not buy, an audit log with blocked-traffic stats and a dashboard widget, a rule simulator and a weekly e-mail report. Try it free for 14 days, no card: <a href=\"https:\/\/huloglobal.com\/wordpress-plugins\/geo-block\/\">huloglobal.com\/wordpress-plugins\/geo-block<\/a>.<\/p>\n\n<h3>External services<\/h3>\n\n<p>This plugin does not connect to any external service. Country lookups use request headers set by your CDN or web server, or, when WooCommerce is active, WooCommerce's own geolocation.<\/p>\n\n<p>If you turn on \"Verify Googlebot and Bingbot by reverse DNS\" (off by default), a visitor whose User-Agent claims to be Googlebot or Bingbot has their IP address looked up in DNS (a reverse lookup, then a forward lookup of the returned host name) through your server's own DNS resolver. The answer is cached for a day. Only the visitor's IP address is involved; no data is sent to Google, Microsoft or HULO. If you enable WooCommerce's MaxMind integration, WooCommerce itself downloads the GeoLite2 database from MaxMind under MaxMind's terms; that is part of WooCommerce, not this plugin.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Install HULO Geo-block from Plugins \u2192 Add New, or upload the zip, and activate it.<\/li>\n<li>Go to HULO \u2192 Geo-block. If the page says no country source was found, put the site behind a CDN that sends the visitor's country (for example Cloudflare), enable a GeoIP module in your web server, or, with WooCommerce, add a MaxMind licence key in WooCommerce \u2192 Settings \u2192 Integration.<\/li>\n<li>On the Rules tab pick the regions or countries you serve, tick \"Apply the country rules to visitors\" and save.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"can%20i%20lock%20myself%20out%3F\"><h3>Can I lock myself out?<\/h3><\/dt>\n<dd><p>No. Administrators (and shop managers when WooCommerce is active) are never blocked, wp-admin and the login page are never blocked, and the plugin will not switch on rules that would allow no one.<\/p><\/dd>\n<dt id=\"do%20i%20need%20woocommerce%3F\"><h3>Do I need WooCommerce?<\/h3><\/dt>\n<dd><p>No. Geo-block works on any WordPress site. WooCommerce adds checkout protection and its MaxMind geolocation.<\/p><\/dd>\n<dt id=\"what%20happens%20when%20a%20visitor%27s%20country%20is%20unknown%3F\"><h3>What happens when a visitor's country is unknown?<\/h3><\/dt>\n<dd><p>They are allowed. Set up a country source (CDN headers, a web-server GeoIP module, or WooCommerce's MaxMind integration) so countries are known.<\/p><\/dd>\n<dt id=\"does%20it%20work%20with%20page%20caching%3F\"><h3>Does it work with page caching?<\/h3><\/dt>\n<dd><p>Yes. Block pages are never cached. If your cache serves HTML without running WordPress, turn on the page-cache helper on the Settings tab. With WooCommerce, checkout always re-checks on the server.<\/p><\/dd>\n<dt id=\"will%20google%20still%20index%20my%20store%3F\"><h3>Will Google still index my store?<\/h3><\/dt>\n<dd><p>Yes, by default search and link-preview crawlers are let through.<\/p><\/dd>\n<dt id=\"can%20a%20visitor%20fake%20their%20country%20or%20pretend%20to%20be%20googlebot%3F\"><h3>Can a visitor fake their country or pretend to be Googlebot?<\/h3><\/dt>\n<dd><p>Country headers are only believed when the request comes from a proxy you trust, so a visitor cannot send their own. A crawler User-Agent only lets a visitor browse, never buy or pay, and with reverse-DNS verification on, a fake Googlebot or Bingbot is treated like any other visitor.<\/p><\/dd>\n<dt id=\"does%20the%20plugin%20contact%20any%20external%20service%3F\"><h3>Does the plugin contact any external service?<\/h3><\/dt>\n<dd><p>No. See \"External services\" below.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>0.1.1<\/h4>\n\n<ul>\n<li>Security: crawler User-Agents may browse but never buy or pay; CDN country and IP headers are honoured only from trusted proxies (off by default); REST and WooCommerce endpoint exemptions follow what WordPress actually routed; optional reverse-DNS verification of Googlebot and Bingbot.<\/li>\n<li>The block page's styles are registered and printed through WordPress, and settings forms read and sanitise each declared field.<\/li>\n<\/ul>\n\n<h4>0.1.0<\/h4>\n\n<ul>\n<li>First release for any WordPress site: country and region-preset rules, always-blocked countries, IP allowlist (IPv4\/IPv6 CIDR), crawler allowlist, branded block page or redirect, business hours, maintenance window, CDN\/web-server geolocation, bundled country list, page-cache helper, headless check endpoint and extension hooks.<\/li>\n<li>With WooCommerce: checkout and add-to-cart guards (classic and Checkout block) and WooCommerce\/MaxMind geolocation. With HULO Payments: payments from blocked visitors are refused.<\/li>\n<\/ul>","raw_excerpt":"Allow or block visitors by country or region on any WordPress site, with IP and crawler allowlists, a branded block page and business hours.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/396920","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=396920"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/huloglobal"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=396920"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=396920"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=396920"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=396920"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=396920"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=396920"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}