rbonfil

Geosec is a lightweight security plugin designed to protect your WordPress administration panel (<code>wp-admin</code>). It works by detecting the visitor’s country using their IP address and allowing access only if they are in your “Allowed Countries” whitelist.
This significantly hardens your admin panel against brute-force attacks, bot login attempts, and unauthorized access from foreign countries.
<h3>Key Features</h3>
<ul>
<li>Whitelist-based Protection: Only allow access from specific countries.</li>
<li>Emergency Key: Create a unique URL to bypass the lock if you are traveling.</li>
<li>Cloudflare Compatible: Works seamlessly with Cloudflare and standard server setups.</li>
<li>Detailed Statistics: View logs of blocked attempts and valid logins, including Top Blocked Countries and IPs.</li>
<li>Lightweight: Optimized for performance, querying external APIs only when necessary and caching results.</li>
</ul>

Geosec

Geosec protects your admin panel (wp-admin) by allowing access only from the countries you authorize.

topsyde

CountryLock provides a simple, lightweight way to allow or block countries from accessing your WordPress site.
It’s designed to be “set it and forget it” with no upsells, ads, or complex configurations.
<h3>✨ Key Features</h3>
<ul>
<li>Master Toggle: Enable or disable the firewall with a single click.</li>
<li>Allowed Countries List: Specify which two-letter country codes (e.g., <code>US</code>, <code>CA</code>) are allowed. Everyone else is blocked.</li>
<li>Admin Bypass: Logged-in administrators can always bypass the block (toggleable).</li>
<li>IP Allowlist: A simple list of IPs or CIDR ranges (like <code>123.45.67.89</code> or <code>10.0.0.0/8</code>) that are always allowed.</li>
<li>Block Logging: See which countries and IPs are being blocked (toggleable).</li>
<li>Zero-Lookup Detection: Automatically uses Cloudflare (<code>HTTP_CF_IPCOUNTRY</code>) and other common server-level GEO headers for instant decisions with zero performance impact.</li>
<li>Remote Lookup: As a fallback, it can query an external service (<code>ipapi.co</code>) if no headers are found.</li>
</ul>
<h3>External Services</h3>
This plugin uses one external service as a fallback to determine a visitor’s country if no local GEO headers (like those from Cloudflare or a server-level GeoIP module) are present.
<ul>
<li>Service: <code>ipapi.co</code></li>
<li>What it’s used for: To look up the country of origin for a visitor’s IP address.</li>
<li>Data Sent: The visitor’s IP address is sent to the service. This happens only if the “Use remote lookup if no geo headers” setting is enabled AND no local GeoIP headers are detected.</li>
<li>Service Policies:
<ul>
<li><a href="https://ipapi.co/terms/" rel="nofollow ugc">Terms of Service</a></li>
<li><a href="https://ipapi.co/privacy/" rel="nofollow ugc">Privacy Policy</a></li>
</ul>
</li>
</ul>

CountryLock

Block/allow countries with one toggle. Lightweight, no upsells. Includes admin bypass, IP allowlist, and block stats.

Geosec vs CountryLock