Advanced Country Blocker

Advanced Country Blocker helps you secure your WordPress site by restricting access based on the visitor’s geolocation (country) or IP address. Upon activation, the plugin detects the activating admin’s country and automatically sets that as the only allowed country. All other visitors from different countries are blocked, unless they use a secret key parameter to temporarily whitelist their IP. Country detection uses the privacy-friendly ip-api.com service by default but can be switched to a fully offline MaxMind GeoLite2 (or compatible) database file once you configure a local copy.

Key Features:

• Automatically allows the admin’s country on plugin activation.
• Flexible IP-to-country lookups – start with the built-in ip-api.com integration and optionally switch to an offline MaxMind GeoLite2 Country (or compatible) .mmdb database file.
• Allowlist or blacklist mode – choose whether the country list acts as an allowlist or blocklist without re-entering countries.
• Temporary access via a customizable secret URL parameter (e.g., ?MySecretKey=1).
• CAPTCHA Challenge – allow blocked visitors to solve a CAPTCHA to gain temporary access (supports Google reCAPTCHA v2/v3, hCaptcha, Cloudflare Turnstile).
• Real-Time Activity Monitor – live dashboard showing active visitors, recent blocks, and traffic statistics.
• Analytics Dashboard – comprehensive charts and statistics about blocked attempts.
• Manual blacklisting and safelisting of IPs for added security and to accommodate uptime monitors.
• Optional email alerts when new visitors are blocked.
• Admin bypass so logged-in admins can always access the site (toggleable in the code).
• Detailed logging of blocked attempts in a custom database table, displayed in the WP admin.
• Custom response controls – personalise the block page title/message, choose the HTTP status (403, 410, 451) or redirect to any URL.
• Automatic log cleanup with configurable retention plus a one-click “Clear Logs” button.

Use the plugin settings page (Country Blocker menu in WP admin) to configure the list of allowed countries, blacklisted countries, blacklisted IPs, and whether email alerts are enabled.

License

This plugin is open-sourced software licensed under the GPLv3 or later.

External Services

By default this plugin contacts the ip-api.com geolocation service to detect visitor countries. You can disable all external lookups by switching the IP lookup method to the local MaxMind database in the settings.