Nexiby LLC

Atiqur Rahman

NexiGuard – IP & Geo Access Control is a public WordPress access control plugin for administrators who need to restrict site access using local IP rules and optional GeoIP data.
Features include:
<ul>
<li>Block List mode: visitors matching rules are blocked.</li>
<li>Allow List mode: only visitors matching rules are allowed.</li>
<li>Exact IP address rules.</li>
<li>CIDR range rules for IPv4 and IPv6.</li>
<li>Country and region/state rules when a GeoIP provider is configured.</li>
<li>Optional blocking for the frontend, login page, REST API, and XML-RPC.</li>
<li>403, 404, or custom blocked responses.</li>
<li>Custom blocked messages with plain text and basic safe HTML.</li>
<li>Safe visitor IP detection using REMOTE_ADDR by default.</li>
<li>Optional Cloudflare visitor IP detection.</li>
<li>Optional trusted proxy header support.</li>
<li>Bulk import for IP/CIDR rules.</li>
<li>Export and import settings as JSON.</li>
<li>Optional minimal blocked-attempt logs.</li>
<li>Admin lockout protection and an emergency bypass constant.</li>
</ul>
<h4>Privacy and GeoIP</h4>
IP blocking works without any third-party service. Country and region blocking requires either a readable local GeoIP database or an explicitly configured API provider.
Visitor IP addresses are not sent externally unless an administrator selects API provider mode and configures an API endpoint. Optional logs store only date/time, IP address, matched rule type, and requested path.
<h4>Admin safety</h4>
NexiGuard is disabled by default after activation. Logged-in administrators are never blocked by default. The admin screen displays the detected admin IP and requires confirmation before adding an IP/CIDR rule that matches it.
Emergency bypass: define <code>NEXIGUARD_DISABLE</code> as <code>true</code> in <code>wp-config.php</code> to stop all blocking.
<h3>External Services</h3>
NexiGuard does not contact any external service by default.
If an administrator selects API provider mode and configures an API endpoint, NexiGuard sends a GET request to that administrator-configured endpoint to look up country and region data for visitor IP addresses. The visitor IP address is sent in the configured URL using the <code>{ip}</code> placeholder or as an <code>ip</code> query parameter. If an API key is configured, it is sent as a Bearer token in the Authorization header.
Because the API endpoint is entered by the site administrator, the site owner is responsible for reviewing that provider’s terms of service and privacy policy before enabling API provider mode.
Local IP and CIDR blocking do not use any external service. MaxMind mode reads a local database file and does not send visitor IPs externally.
<h3>License</h3>
NexiGuard – IP & Geo Access Control is licensed under GPL-2.0-or-later.

NexiGuard – IP & Geo Access Control

Restrict website access by IP addresses, CIDR ranges, countries, and regions.

CordonAI

CordonAI Geo Access and Redirect lets you decide who can reach your WordPress 
site based on the visitor’s country and IP address. Everything runs through 
standard WordPress hooks — the plugin never modifies <code>wp-config.php</code>, 
 .htaccess, or any core file.
Country lookups use a bundled MaxMind GeoLite2 database that ships with the 
plugin, so no external request is made when a visitor is checked. If you 
want fresher data you can add a free MaxMind license key and update the 
database on demand or weekly.
Features
<ul>
<li>Block (or allow) front-end visitors by country and by IP address.</li>
<li>Protect the login page and admin area by country/IP, with brute-force-friendly 
defaults — established administrators are never locked out of the dashboard.</li>
<li>IP rules support exact addresses, wildcards (<code>203.0.113.*</code>) and CIDR ranges 
(<code>203.0.113.0/24</code>), for both IPv4 and IPv6.</li>
<li>Allow-list that always wins over any block rule.</li>
<li>Crawler allow-list (Google, Bing, Yandex, and more) so blocking a country 
never hurts your search visibility.</li>
<li>Country redirects, including “keep the current path” (<code>%PATH%</code>) redirects.</li>
<li>Language-prefix URL rewriting for multilingual sites (e.g. <code>/en/</code> → <code>/it/</code>).</li>
<li>Logs and at-a-glance charts of blocked activity (24 hours / 7 days / 30 days).</li>
<li>Fully customisable block screen with a live preview.</li>
<li>Offline by design — privacy friendly, no tracking, no ads, no upsells.</li>
<li>Optional MaxMind GeoLite2 auto-update with your own license key.</li>
</ul>
<h3>External services</h3>
This plugin can optionally connect to one external service, MaxMind, to update 
its bundled GeoIP database. It is used only for downloading database updates and 
is never contacted during normal visitor lookups.
<ul>
<li>What it is and what it is used for: MaxMind GeoLite2 provides the 
IP-to-country database the plugin uses to detect a visitor’s country. The 
bundled copy works fully offline; this service is only used to download a newer 
copy of that database when you choose to.</li>
<li>What data is sent and when: a request is sent to 
https://download.maxmind.com/app/geoip_download only when a site administrator 
has entered a MaxMind license key and then either clicks “Update database now” 
on the Settings tab or has enabled the weekly automatic update. The request 
includes your MaxMind license key (so MaxMind can authorise the download) and, 
as with any HTTP request, your server’s IP address. No visitor data and no site 
content are ever sent. If you do not enter a license key, the plugin makes no 
external requests at all.</li>
<li>Service provider: MaxMind, Inc. 
GeoLite2 End User License Agreement: https://www.maxmind.com/en/geolite2/eula 
Privacy Policy: https://www.maxmind.com/en/privacy-policy</li>
</ul>

CordonAI Geo Access and Redirect

Block or allow WordPress visitors by country and IP, redirect by location, and log activity using an offline GeoIP database.

NexiGuard – IP & Geo Access Control vs CordonAI Geo Access and Redirect