SDLC Corp

The SDLC Country Block plugin lets you restrict access to individual posts and pages based on the visitor’s country, while keeping SEO bots and crawlers unblocked for safe indexing.
<h3>🔐 4 Layers of Country Detection</h3>
To ensure maximum compatibility, the plugin checks for the visitor’s country in this order: 
1. Cloudflare header (<code>CF-IPCountry</code>) 
2. Server GeoIP variables (if your hosting environment provides them) 
3. PHP GeoIP extension (<code>geoip_country_code_by_name</code>) 
4. Wordfence plugin (using Wordfence GEO detection)
⚠️ Note: At least one of these extensions or plugins must be enabled. If none are active, the plugin cannot detect visitor countries.
<h3>✨ Features</h3>
<ul>
<li>Per-post/page multi-select of countries (full ISO list)</li>
<li>SEO-safe: bots/crawlers can bypass blocks</li>
<li>Choose action: redirect to endpoint (/blocked), redirect to custom URL, or 403</li>
<li>Customizable endpoint slug</li>
<li>Role-based bypass (e.g., admin, editor)</li>
<li>Optional admin-only debug banner</li>
<li>Proper sanitization, escaping, and nonces</li>
<li>Sets <code>Vary: CF-IPCountry</code> for cache correctness</li>
<li>Clean uninstall (removes options and post meta)</li>
</ul>
This plugin is maintained by <a href="https://sdlccorp.com/" rel="nofollow ugc">SDLC CORP</a> — a Digital Transformation Company with expertise in: 
– WordPress Development 
– Shopify Solutions 
– Artificial Intelligence (AI) & Machine Learning 
– Model Development and NLP (Natural Language Processing) 
– Enterprise-grade <a href="https://sdlccorp.com/ai-development-services/" rel="nofollow ugc">AI Development Services</a>
By publishing this open-source plugin, SDLC CORP demonstrates its commitment to empowering developers and businesses with scalable AI-driven solutions and modern web technologies.
<h3>Requirements & Compatibility</h3>
For the plugin to work, at least one of the following extensions or plugins must be enabled on your server:
<ol>
<li>Cloudflare → Enable the IP Geolocation setting in your Cloudflare dashboard (adds the <code>CF-IPCountry</code> header).</li>
<li>Server GeoIP → Your hosting provider must support GeoIP (ask your host if they provide <code>GEOIP_COUNTRY_CODE</code>).</li>
<li>PHP GeoIP Extension → Install and enable the PHP <code>geoip</code> extension on your server (may require server admin/hosting support).</li>
<li>Wordfence Plugin → Install the free <a href="https://wordpress.org/plugins/wordfence/" rel="ugc">Wordfence Security plugin</a> and enable its country blocking/GeoIP feature.</li>
</ol>
➡️ At least one of these must be active. If none are available, the plugin cannot detect visitor countries.
<h3>Third-Party Compatibility</h3>
This plugin is designed to work with third-party services such as Cloudflare and Wordfence when available. 
SDLC Country Block is an independent plugin and is not affiliated with or endorsed by Cloudflare or Wordfence.
<h3>License</h3>
This plugin is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, version 2 of the License, or (at your option) any later version.
This plugin is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
A copy of the GPL v2 license is included in this package. You can also see <a href="https://www.gnu.org/licenses/gpl-2.0.html" rel="nofollow ugc">https://www.gnu.org/licenses/gpl-2.0.html</a>.
<h3>Trademark</h3>
“SDLC CORP” and the SDLC CORP logo are trademarks of SDLC CORP. 
The GPL license covers the plugin’s source code. It does not grant rights to use SDLC CORP’s trademarks or branding in modified versions in a way that suggests endorsement or affiliation without permission.

Country Access Control

Block access to selected posts/pages by visitor country, with SEO-safe bot bypass and customizable redirects.

Darko G.

IP Location Block plugin that allows you to block access to your site based on the visitor location while also keeping your site safe from malicious attacks. The plugin brings a smart and powerful protection methods named as “WP Zero-day Exploit Prevention” and “WP Metadata Exploit Protection“.
Combined with those methods and IP address geolocation, you’ll be surprised to find a bunch of malicious or undesirable access blocked in the logs of this plugin after several days of installation.
Note: This plugin is based on the now abandoned “IP Geo Block” plugin by tokkonopapa. I fixed various issues and improved the overall codebase.
<h4>Features</h4>
<ul>
<li>
Native Geo-Location Provider 
IP Location Block provides <a href="https://iplocationblock.com/codex/native-geo-location-provider/?utm_source=plugin&utm_medium=wporgpage&utm_campaign=readme" rel="nofollow ugc">Native Geo-Location Provider</a> that is faster, more secure and provides the needed precision for matching CITY and STATE besides the standard COUNTRY matching.
</li>
<li>
Privacy by design: 
IP address is always encrypted on recording in logs/cache. Moreover, it can be anonymized and restricted on sending to the 3rd parties such as geolocation APIs or whois service.
</li>
<li>
Immigration control: 
Access to the basic and important entrances into back-end such as <code>wp-comments-post.php</code>, <code>xmlrpc.php</code>, <code>wp-login.php</code>, <code>wp-signup.php</code>, <code>wp-admin/admin.php</code>, <code>wp-admin/admin-ajax.php</code>, <code>wp-admin/admin-post.php</code> will be validated by means of a country code based on IP address. It allows you to configure either whitelist or blacklist to <a href="https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2#Officially_assigned_code_elements" title="ISO 3166-1 alpha-2 - Wikipedia" rel="nofollow ugc">specify the countires</a>, <a href="https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing" title="Classless Inter-Domain Routing - Wikipedia" rel="nofollow ugc">CIDR notation</a> for a range of IP addresses and <a href="https://en.wikipedia.org/wiki/Autonomous_system_(Internet)" title="Autonomous system (Internet) - Wikipedia" rel="nofollow ugc">AS number</a> for a group of IP networks.
</li>
<li>
Zero-day Exploit Prevention: 
Unlike other security firewalls based on attack patterns (vectors), the original feature “WordPress Zero-day Exploit Prevention” (WP-ZEP) is focused on patterns of vulnerability. It is simple but still smart and strong enough to block any malicious accesses to <code>wp-admin/*.php</code>, <code>plugins/*.php</code> and <code>themes/*.php</code> even from the permitted countries. It will protect your site against certain types of attack such as CSRF, LFI, SQLi, XSS and so on, even if you have some vulnerable plugins and themes in your site.
</li>
<li>
Guard against login attempts: 
In order to prevent hacking through the login form and XML-RPC by brute-force and the reverse-brute-force attacks, the number of login attempts will be limited per IP address even from the permitted countries.
</li>
<li>
Minimize server load against brute-force attacks: 
You can configure this plugin as a <a href="https://codex.wordpress.org/Must_Use_Plugins" title="Must Use Plugins « WordPress Codex" rel="nofollow ugc">Must Use Plugins</a> so that this plugin can be loaded prior to regular plugins. It can massively <a href="https://iplocationblock.com/codex/validation-timing/" title="Validation timing | IP Location Block" rel="nofollow ugc">reduce the load on server</a>.
</li>
<li>
Prevent malicious down/uploading: 
A malicious request such as exposing <code>wp-config.php</code> or uploading malwares via vulnerable plugins/themes can be blocked.
</li>
<li>
Block badly-behaved bots and crawlers: 
A simple logic may help to reduce the number of rogue bots and crawlers scraping your site.
</li>
<li>
Support of BuddyPress and bbPress: 
You can configure this plugin so that a registered user can login as a membership from anywhere, while a request such as a new user registration, lost password, creating a new topic and subscribing comment can be blocked by country. It is suitable for <a href="https://wordpress.org/plugins/buddypress/" title="BuddyPress — WordPress Plugins" rel="ugc">BuddyPress</a> and <a href="https://wordpress.org/plugins/bbpress/" title="WordPress › bbPress « WordPress Plugins" rel="ugc">bbPress</a> to help reducing spams.
</li>
<li>
Referrer suppressor for external links: 
When you click an external hyperlink on admin screens, http referrer will be eliminated to hide a footprint of your site.
</li>
<li>
Multiple source of IP Geolocation databases: 
Besides the <a href="https://iplocationblock.com/codex/native-geo-location-provider/?utm_source=plugin&utm_medium=wporgpage&utm_campaign=readme" rel="nofollow ugc">Native Geo-Location provider</a>, this plugin supports <a href="https://www.maxmind.com" title="MaxMind - IP Geolocation and Online Fraud Prevention" rel="nofollow ugc">MaxMind GeoLite2 free databases</a> and <a href="https://www.ip2location.com/" title="IP Address Geolocation to Identify Website Visitor's Geographical Location" rel="nofollow ugc">IP2Location LITE databases</a>. Also free Geolocation REST APIs and whois information can be available for audit purposes. 
Father more, <a href="https://iplocationblock.com/cloudflare-cloudfront-api-class-library/" title="CloudFlare & CloudFront API class library | IP Location Block" rel="nofollow ugc">dedicated API class libraries</a> can be installed for CloudFlare and CloudFront as a reverse proxy service.
</li>
<li>
Customizing response: 
HTTP response code can be selectable as <code>403 Forbidden</code> to deny access pages, <code>404 Not Found</code> to hide pages or even <code>200 OK</code> to redirect to the top page. 
You can also have a human friendly page (like <code>404.php</code>) in your parent/child theme template directory to fit your site design.
</li>
<li>
Validation logs: 
Validation logs for useful information to audit attack patterns can be manageable.
</li>
<li>
Cooperation with full spec security plugin: 
This plugin is lite enough to be able to cooperate with other full spec security plugin such as <a href="https://wordpress.org/plugins/wordfence/" title="Wordfence Security — WordPress Plugins" rel="ugc">Wordfence Security</a>. See <a href="https://iplocationblock.com/codex/page-speed-performance/" title="Page speed performance | IP Location Block" rel="nofollow ugc">this report</a> about page speed performance.
</li>
<li>
Extendability: 
You can customize the behavior of this plugin via <code>add_filter()</code> with <a href="https://iplocationblock.com/codex/" title="Codex | IP Location Block" rel="nofollow ugc">pre-defined filter hook</a>. See various use cases in <a href="https://iplocationblock.com/codex/example-use-cases-for-the-developer-hooks/" rel="nofollow ugc">samples.php</a> bundled within this package. 
You can also get the extension <a href="https://github.com/ddur/WordPress-IP-Geo-Allow" title="GitHub - ddur/WordPress-IP-Geo-Allow: WordPress Plugin Exension for WordPress-IP-Geo-Block Plugin" rel="nofollow ugc">IP Geo Allow</a> by <a href="https://github.com/ddur" title="ddur (Dragan) - GitHub" rel="nofollow ugc">Dragan</a>. It makes admin screens strictly private with more flexible way than specifying IP addresses.
</li>
<li>
Self blocking prevention and easy rescue: 
Website owners do not prefer themselves to be blocked. This plugin prevents such a sad thing unless you force it. And futhermore, if such a situation occurs, you can <a href="https://iplocationblock.com/codex/what-should-i-do-when-im-locked-out/" title="What should I do when I'm locked out? | IP Location Block" rel="nofollow ugc">rescue yourself</a> easily.
</li>
<li>
Clean uninstallation: 
Nothing is left in your precious mySQL database after uninstallation. So you can feel free to install and activate to make a trial of this plugin’s functionality.
</li>
</ul>
<h4>Documentation</h4>
Documentation and more information can always be found on our <a href="https://iplocationblock.com/" title="IP Location Block" rel="nofollow ugc">plugin website</a>.
<h4>Attribution</h4>
This package includes GeoLite2 library distributed by MaxMind, available from <a href="https://www.maxmind.com" title="MaxMind - IP Geolocation and Online Fraud Prevention" rel="nofollow ugc">MaxMind</a>, and also includes IP2Location open source libraries available from <a href="https://www.ip2location.com" title="IP Address Geolocation to Identify Website Visitor's Geographical Location" rel="nofollow ugc">IP2Location</a>.
Also thanks for providing the following services and REST APIs for free.
<ul>
<li><a href="http://geoiplookup.net/" title="What Is My IP Address | GeoIP Lookup" rel="nofollow ugc">http://geoiplookup.net/</a> (IPv4, IPv6 / free)</li>
<li><a href="https://ipinfo.io/" title="IP Address API and Data Solutions" rel="nofollow ugc">https://ipinfo.io/</a> (IPv4, IPv6 / free)</li>
<li><a href="https://ipapi.com/" title="ipapi - IP Address Lookup and Geolocation API" rel="nofollow ugc">https://ipapi.com/</a> (IPv4, IPv6 / free, need API key)</li>
<li><a href="https://ipstack.com/" title="ipstack - Free IP Geolocation API" rel="nofollow ugc">https://ipstack.com/</a> (IPv4, IPv6 / free, need API key)</li>
<li><a href="https://ipinfodb.com/" title="Free IP Geolocation Tools and API| IPInfoDB" rel="nofollow ugc">https://ipinfodb.com/</a> (IPv4, IPv6 / free, need API key)</li>
</ul>
<h4>Development</h4>
Development of this plugin happens at <a href="https://github.com/gdarko/ip-location-block" title="gdarko/ip-location-block - GitHub" rel="nofollow ugc">IP Location Block – GitHub</a>
All contributions will always be welcome.
<h4>Known issues</h4>
<ul>
<li>From <a href="https://make.wordpress.org/core/2016/03/09/comment-changes-in-wordpress-4-5/" title="Comment Changes in WordPress 4.5 – Make WordPress Core" rel="nofollow ugc">WordPress 4.5</a>, <code>rel=nofollow</code> had no longer be attached to the links in <code>comment_content</code>. This change prevents to block “<a href="https://www.owasp.org/index.php/Server_Side_Request_Forgery" title="Server Side Request Forgery - OWASP" rel="nofollow ugc">Server Side Request Forgeries</a>” (not Cross Site but a malicious internal link in the comment field).</li>
<li><a href="https://apps.wordpress.com/mobile/" title="WordPress.com Apps - Mobile Apps" rel="nofollow ugc">WordPress.com Mobile App</a> can’t execute image uploading because of its own authentication system via XMLRPC.</li>
</ul>

IP Location Block


This plugin is a lifesaver for managing access by location. Setup was quick and straightforward, and it’s been working perfectly right out of the box. Since installing it, I’ve noticed a significant decrease in suspicious login attempts. If you want an easy, reliable way to block visitors from certain countries, this is an excellent choice. A practical and well-built plugin!


Exactly What I Needed for GEO Blocking!

Easily block visitors by country, state or ISP provider. Also, protects your site from spam, login attempts, zero-day exploits, malicious access & …

Country Access Control vs IP Location Block