topsyde

CountryLock provides a simple, lightweight way to allow or block countries from accessing your WordPress site.
It’s designed to be “set it and forget it” with no upsells, ads, or complex configurations.
<h3>✨ Key Features</h3>
<ul>
<li>Master Toggle: Enable or disable the firewall with a single click.</li>
<li>Allowed Countries List: Specify which two-letter country codes (e.g., <code>US</code>, <code>CA</code>) are allowed. Everyone else is blocked.</li>
<li>Admin Bypass: Logged-in administrators can always bypass the block (toggleable).</li>
<li>IP Allowlist: A simple list of IPs or CIDR ranges (like <code>123.45.67.89</code> or <code>10.0.0.0/8</code>) that are always allowed.</li>
<li>Block Logging: See which countries and IPs are being blocked (toggleable).</li>
<li>Zero-Lookup Detection: Automatically uses Cloudflare (<code>HTTP_CF_IPCOUNTRY</code>) and other common server-level GEO headers for instant decisions with zero performance impact.</li>
<li>Remote Lookup: As a fallback, it can query an external service (<code>ipapi.co</code>) if no headers are found.</li>
</ul>
<h3>External Services</h3>
This plugin uses one external service as a fallback to determine a visitor’s country if no local GEO headers (like those from Cloudflare or a server-level GeoIP module) are present.
<ul>
<li>Service: <code>ipapi.co</code></li>
<li>What it’s used for: To look up the country of origin for a visitor’s IP address.</li>
<li>Data Sent: The visitor’s IP address is sent to the service. This happens only if the “Use remote lookup if no geo headers” setting is enabled AND no local GeoIP headers are detected.</li>
<li>Service Policies:
<ul>
<li><a href="https://ipapi.co/terms/" rel="nofollow ugc">Terms of Service</a></li>
<li><a href="https://ipapi.co/privacy/" rel="nofollow ugc">Privacy Policy</a></li>
</ul>
</li>
</ul>

CountryLock

Block/allow countries with one toggle. Lightweight, no upsells. Includes admin bypass, IP allowlist, and block stats.

Iulia Cazan

This plugin hooks in the authenticate filter. By default, the plugin is set to allow all access and you can configure the plugin to allow the login only from some specified IPs or the specified countries. PLEASE MAKE SURE THAT YOU CONFIGURE THE PLUGIN TO ALLOW YOUR OWN ACCESS. If you set a restriction by IP, then you have to add your own IP (if you are using the plugin in a local setup the IP is 127.0.0.1 or ::1, this is added in your list by default). If you set a restriction by country, then you have to select from the list of countries at least your country. Both types of restrictions work independent, so you can set only one type of restriction or both if you want. Also, you can configure the redirects to frontpage when the URLs are accessed by someone that has a restriction. The restriction is either by country, or not in the specified IPs list.
<h3>License</h3>
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Login IP & Country Restriction


I'd like to be able to redirect to a specific page, that doesn't seem possible in free or PRO version.


Good Set of Free Options (Except for redirection)

Tighten your website security and fight against dictionary bot attacks originating from other countries, by denying access.

CountryLock vs Login IP & Country Restriction