Country Blocker & Geoblocker

Requirements

Installation

1. Download the ZIP file from your account
2. Go to Plugins → Add New → Upload Plugin
3. Upload the ZIP and click Install Now
4. Click Activate

Uninstalling

Deactivate and delete from the Plugins screen. Scheduled cron events are cleared on deactivation. Options stored under bsas_* in the wp_options table and the wp_bsas_logs table remain in your database; remove them manually for a completely clean removal.

Quick Start

1. Open Geoblocker (Paid) in your WordPress admin sidebar
2. On the General tab, confirm Enable Geoblocking is on (it is by default)
3. Go to the Countries tab and check the countries or continents you want to block
4. Click Save
5. Optionally set up regions, redirect rules, schedules, IP lists, and a custom block page on the other tabs

Visitors from the selected locations immediately see a “403 Access Restricted” block page. Customize it on the Block Page tab.

Core Settings (General Tab)

Log Mode

Unknown Location Policy

Blocking Mode

Behind a Proxy / CDN

By default the plugin trusts the direct connection IP, which is the safe choice and prevents IP-spoofing bypasses.

AI Scrapers & Bots

Use this to keep your content out of AI training datasets and to cut crawler bandwidth. Legitimate search-engine crawlers are unaffected when “Allow Search Crawlers” is on.

Hosting, VPN & Network Blocking

Test an IP Address

Right on the General tab you can enter any IP and see exactly how the plugin would handle it against your current settings — the detected country/region, the decision (blocked, allowed, or bypassed), and the reason. A dedicated IP Tester is also available on the Tools tab.

Admin Access & URL Allow List

WordPress Admin Access

The WordPress admin area and login page are never blocked by default, so you can't lock yourself out. An optional Block WordPress admin area toggle is available if you specifically want geo rules applied to /wp-admin/ as well.

Never Block These URLs

Enter URLs or path fragments (one per line) that should always bypass blocking — for example a webhook endpoint, a health-check URL, or a public landing page you want reachable from everywhere.

Live World Map

The General tab includes an interactive world map (bundled locally, no external requests) that color-codes every country by its current status:

Above the map, live counters show total blocked, last 24h, and last 7d so you can see your blocking activity at a glance.

Countries & Continents (Countries Tab)

Block Countries

A searchable grid of 250+ countries and territories. Use the search box to find a country fast, or the Select All / Deselect All buttons for bulk actions. Checked entries are affected according to your Blocking Mode.

Block Continents

Block entire continents with one checkbox: Africa, Antarctica, Asia, Europe, North America, Oceania, and South America. Continent selections stack with individual country selections.

Regions / States (Regions Tab)

Block at a sub-country level for seven countries:

Rules Tab

Redirect Rules

Instead of showing the block page, send visitors from a specific location to a custom URL (302 redirect). Each rule has a Type (Country, Continent, US State, CA Province, UK Region, AU State, DE State, IN State, or CN Province), a Value (the location to match), and a URL. Click + Add Rule for more. Redirect rules are checked before the normal block page; the first match wins and is independent of your blocked list.

Blocking Schedules

Create time-based profiles, each with a name, the days it's active, and a start/end hour (24-hour format, overnight spans supported). Blocking is active when any enabled schedule matches the current day and time; if no schedules are enabled, blocking runs 24/7. Times follow your WordPress timezone.

Page-Level Blocking

Restrict blocking to specific pages instead of the whole site. Add pages from the selector, then choose Block ONLY these pages or Block all EXCEPT these pages (handy for keeping a landing page or legal notice open to everyone).

Automation Tab

Auto-Block Repeat Offenders

Automatically blacklist IPs that keep hitting the block page. Set a Threshold (number of blocked hits) and a Period (Per Hour or Per Day). When an IP exceeds the threshold within the period it's added to the IP blacklist automatically.

WooCommerce Integration

IP Lists Tab

IP Whitelist

IPs or ranges that always bypass blocking, regardless of location. Whitelisted visitors are logged as “bypassed.”

IP Blacklist

IPs or ranges that are always blocked, regardless of location, with no geo lookup.

Both fields accept IPv4, IPv6, and CIDR notation, one entry per line — e.g. 192.168.1.1, 2001:db8::1, 192.168.1.0/24. Lines starting with # are treated as comments.

Block Page Tab

Redirect (Optional)

Enter a URL to send all blocked visitors to instead of showing the block page. When set, the design settings below are ignored.

Block Page Colors

Block Page Content

Custom CSS

Add CSS to further style the block page. Available classes include .bsas-block-body, .bsas-panel, .bsas-icon, plus h1 and p.

Live Preview

A real-time preview shows exactly how your block page looks as you adjust colors and text.

Logs Tab

A paginated table of access log entries, newest first. Each row shows the detected country and region, the decision (Blocked, Allowed, Bypassed, or Error), the reason (e.g. country_blocked, region_blocked, whitelisted, vpn_datacenter, ai_bot, redirect_rule), the requested URI, and the timestamp.

Log Retention Settings

Log export is available on the Tools tab and the CSV is sanitized against spreadsheet formula injection.

Tools Tab

Export Settings

Download all plugin settings as a single JSON file — handy for backups or copying a configuration to another site.

Import Settings

Upload a previously exported JSON file to restore or clone your configuration.

IP Tester

Enter any IP address to preview the exact decision the plugin would make for it against your live rules — the same tester that appears on the General tab.

Support Tab

The Support tab links to priority support and help resources. For account or licensing questions, visit plugins-for-wp.com.

How Blocking Works

On each frontend request the plugin runs checks roughly in this order:

1. Admin / cron / AJAX? — admin, WP-CLI, cron, and AJAX requests skip blocking entirely
2. Plugin enabled? — if the master toggle is off, everyone is allowed
3. REST API — /wp-json/ is excluded unless Block REST API is on
4. Bypass cookie — a recent allowed visitor passes through without a re-check
5. IP whitelist / blacklist — whitelisted IPs are allowed; blacklisted IPs are blocked with no geo lookup
6. Crawler check — verified search crawlers are allowed when that setting is on
7. AI & bot check — AI scraper bots are blocked when that setting is on
8. Schedule check — if no active schedule matches, blocking is paused
9. Resolve visitor IP — the connection IP is used by default; proxy headers are only read if you've enabled them
10. Geo lookup — country/region from cache or the free provider chain
11. Unknown location — the allow/block policy applies if the country can't be determined
12. Redirect rules — a matching rule 302-redirects the visitor
13. Mode evaluation — the country/continent/region is evaluated against your Blocklist or Allowlist selections
14. Hosting / VPN / ASN check — datacenter and custom-network rules apply
15. Page-level check — if enabled, only the targeted pages are affected
16. Allowed — a short bypass cookie is set so the next page load skips the work

Geo Lookup

The plugin determines a visitor's country and region from four free providers, in failover order, with no API keys:

1. ipwhois.is
2. ip-api.com
3. ipapi.co
4. ipinfo.io

All outbound lookups verify TLS certificates. Successful results are cached per IP so repeat visitors trigger no further calls, and failed lookups are cached only briefly — so a temporary provider outage clears quickly instead of lingering for a full day.

Privacy & Data

IP Hashing

Visitor IP addresses are stored as hashes by default, so raw IPs aren't kept. This supports GDPR and general privacy compliance.

What's Stored

External Connections

The only data sent off-site is the visitor IP, to the geolocation providers listed above (over verified TLS). Optional, voluntary deactivation feedback is sent to plugins-for-wp.com only if you submit the form. No tracking scripts or third-party cookies are loaded.

Performance

• Geo lookups are cached per IP — repeat visitors cause no extra API calls
• Allowed visitors get a short bypass cookie, skipping the whole check on later page loads
• Failed providers are skipped automatically and retried; failed lookups are cached only briefly
• Outbound requests use short timeouts so a slow provider can't drag your site down
• Admin, cron, AJAX, and (by default) REST API requests are always excluded
• The world map and its assets are bundled locally and only load in the admin
• A daily cron job trims logs by retention days and max-entry limits

Troubleshooting