brstefanovic

<p><strong>Advanced Country Blocker</strong> helps you secure your WordPress site by restricting access based on the visitor’s geolocation (country) or IP address. Upon activation, the plugin detects the activating admin’s country and automatically sets that as the only allowed country. All other visitors from different countries are blocked, unless they use a secret key parameter to temporarily whitelist their IP. Country detection uses the privacy-friendly ip-api.com service by default but can be switched to a fully offline MaxMind GeoLite2 (or compatible) database file once you configure a local copy.</p>
<p><strong>Key Features:</strong></p>
<ul>
<li><strong>Automatically allows the admin’s country</strong> on plugin activation.</li>
<li><strong>Flexible IP-to-country lookups</strong> – start with the built-in ip-api.com integration and optionally switch to an offline MaxMind GeoLite2 Country (or compatible) <code>.mmdb</code> database file.</li>
<li><strong>Allowlist or blacklist mode</strong> – choose whether the country list acts as an allowlist or blocklist without re-entering countries.</li>
<li><strong>Temporary access</strong> via a customizable secret URL parameter (e.g., <code>?MySecretKey=1</code>).</li>
<li><strong>CAPTCHA Challenge</strong> – allow blocked visitors to solve a CAPTCHA to gain temporary access (supports Google reCAPTCHA v2/v3, hCaptcha, Cloudflare Turnstile).</li>
<li><strong>Real-Time Activity Monitor</strong> – live dashboard showing active visitors, recent blocks, and traffic statistics.</li>
<li><strong>Analytics Dashboard</strong> – comprehensive charts and statistics about blocked attempts.</li>
<li><strong>Manual blacklisting and safelisting of IPs</strong> for added security and to accommodate uptime monitors.</li>
<li><strong>Optional email alerts</strong> when new visitors are blocked.</li>
<li><strong>Admin bypass</strong> so logged-in admins can always access the site (toggleable in the code).</li>
<li><strong>Detailed logging</strong> of blocked attempts in a custom database table, displayed in the WP admin.</li>
<li><strong>Custom response controls</strong> – personalise the block page title/message, choose the HTTP status (403, 410, 451) or redirect to any URL.</li>
<li><strong>Automatic log cleanup</strong> with configurable retention plus a one-click “Clear Logs” button.</li>
</ul>
<p>Use the plugin settings page (<strong>Country Blocker</strong> menu in WP admin) to configure the list of allowed countries, blacklisted countries, blacklisted IPs, and whether email alerts are enabled.</p>
<h3>License</h3>
<p>This plugin is open-sourced software licensed under the <a href="https://www.gnu.org/licenses/gpl-3.0.html" rel="nofollow ugc">GPLv3 or later</a>.</p>
<h3>External Services</h3>
<p>By default this plugin contacts the ip-api.com geolocation service to detect visitor countries. You can disable all external lookups by switching the IP lookup method to the local MaxMind database in the settings.</p>


Advanced Country Blocker


It's a simple plugin that simply works. 



Also, I made it, so ofc 5 stars. =D


Simply works

An advanced security plugin that blocks website visitors by country, with additional features like blacklisting, logging blocked attempts, admin bypas …

hupe13

<p>There are many ways to block unwanted access to your website. This plugin checks which user agent is accessing your website. If it is outdated, unwanted, or suspicious, access is blocked.</p>
<p>Every time your web browser makes a request to a website, it sends a HTTP Header called the “User Agent”. The User Agent string contains information about your web browser name, operating system, device type and lots of other useful bits of information.</p>
<p>The plugin sends with an API the User Agent string of every browser that accesses your website for the first time to <a href="https://api.whatismybrowser.com/api/v2/user_agent_parse" rel="nofollow ugc">https://api.whatismybrowser.com/api/v2/user_agent_parse</a> to obtain following information about the User Agent:</p>
<ul>
<li>Software Name & Version</li>
<li>Operating System Name & Version</li>
</ul>
<p>With this information, the plugin attempts to detect old and bad browsers and denies them access to your website.</p>
<h4>HowTo</h4>
<ul>
<li>Go to <a href="https://developers.whatismybrowser.com/api/pricing/" rel="nofollow ugc">What is my browser?</a> and sign up to the WhatIsMyBrowser.com API for a Basic (free) Application Plan.</li>
<li>Take care about the <a href="https://developers.whatismybrowser.com/api/about/legal/" rel="nofollow ugc">WhatIsMyBrowser.com API Terms and Conditions</a>.</li>
<li>You have a limit of 5000 hits / month for Parsing User Agent. That’s why the plugin manages a database table.</li>
<li>The user agent string of every browser that accesses your website for the first time is sent to this service, and the information is stored this table.</li>
</ul>
<h4>Functions</h4>
<ul>
<li>The plugin checks whether the browser is up to date; it does not check whether the requested page or post actually exists.</li>
<li>Browsers are blocked if the browser and/or system are outdated:
<ul>
<li>Default: Chrome, Edge and Chrome based browsers < 139, Firefox browsers < 140, Safari < 18, Samsung Browser < 28, Internet Explorer, Netscape (!)</li>
<li>Old systems are all Windows versions prior to Windows 10, MacOS prior to Catalina and Android versions < 10 and Symbian.</li>
</ul>
</li>
<li>It will be blocked also if “Software” contains “unknown” or is empty.</li>
<li>You can also set up other browsers.</li>
<li>Sometimes there are false positive, for example, if the browser is from Mastodon. In this case, you can exclude it from the check.</li>
<li>The plugin checks whether the crawlers really originate from Google, Bing, Yandex, Apple, Mojeek, Baidu, Seznam and others.</li>
<li>The plugin blocks browsers like Chrome, Firefox and other without <a href="https://developer.mozilla.org/en-US/docs/Glossary/Fetch_metadata_request_header" rel="nofollow ugc">Sec-Fetch headers</a> (Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest) and incorrect <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Client_hints" rel="nofollow ugc">Client hints</a> (Sec-CH-UA, Sec-CH-UA-Platform).</li>
</ul>
<h4>About robots.txt</h4>
<ul>
<li>You can configure some rewrite rules to provide a robots.txt file that can allow or deny crawling for a browser. If crawling is denied, access to your website will be blocked for that browser.</li>
</ul>
<h4>Logging</h4>
<ul>
<li>The logging can be very detailed. Please check the logs and the WIMB table regularly.</li>
</ul>


Block old browser versions and suspicious browsers

With the help of WhatIsMyBrowser the plugin detects old and bad browsers and denies them access. A special robots.txt denies crawling by bad bots.

Advanced Country Blocker vs Block old browser versions and suspicious browsers