We also recommend you re-evaluate your blocks from time to time. But for most sites, we suggest that you only block problem countries who are regularly creating failed logins, a large number of 404 Not Found response status code errors, and/or are clearly engaged in malicious activity. We do have a few customers who run tightly secured websites and who only allow a single country to access their site. Selecting countries to blockĪs a general philosophy, we recommend you try to minimize the number of countries you are blocking. If you get a warning from Google Ads, uncheck the option “Block access to the rest of the site” to fix this. If you are a participant, you can only block access to the login form. Google Ads does not allow any participant to block any country from viewing pages at all, even if you have told Google Ads to not show adverts in that country. Note that there is no way to get around the Google Ads policy. If you are using Google Ads, we recommend you only use country blocking to block access to the login form. Please note that if you are using Google Ads (formerly Google AdWords) on your site, you may get penalties for blocking access to your site. At this time Country Blocking does not make exceptions for Googlebot and will block it if you block the USA. You can harm your search engine rankings if you block those countries because you can prevent Google, Bing, and other search and aggregation services from crawling your site. If you enable this feature, you will block access for the selected countries to all parts of your site except the login form.īe careful about blocking North America and countries in Europe because there are friendly web crawlers like Google’s Googlebot that are located in those areas. Plugins that are known to be incompatible are:īlock access to the rest of the site (outside the login form) Other plugins that create custom login pages that use the standard WordPress authentication hooks may also be successfully blocked with this option. Login attempts via the WordPress XML-RPC API are also blocked. Using country blocking to block access to your login page is an effective way to immediately stop brute force login attacks from a specific country. Selecting which pages to block access to Block access to the login form For example, logging into the site, submitting a form, or sending data to admin-ajax.php all require PHP to run, so the cache will be skipped, allowing Wordfence to run and block hits when necessary. If you are blocking countries only to reduce risk of attacks, as Wordfence is a security plugin, then these types of caches are ok to use, since visits that are served these cached pages cannot affect the site’s content, files, or database. If it is important to you to block a country from viewing the site at all, then you may need to disable this type of cache, because caching plugins and Varnish generally cannot determine the country that a visitor is from. When using a page caching plugin or an external page cache such as Varnish, the plugin or Varnish can serve cached pages to visitors without WordPress or any plugins (including Wordfence) running, since these caches make a site load faster by sending previously-saved copies of pages to visitors. Detection of IPv6 addresses also may be less accurate as IPv4 address detection for new addresses, as the adoption of IPv6 IP addresses increases over time. These inaccuracies usually occur when an ISP or hosting company moves some of their IP addresses from one country to another, or when an IP address has not been used for some time.Īt times, updates can be applied to the city-level database used on the Live Traffic page before they are applied at the smaller country-only level database that is bundled with the plugin for country blocking, so if you see a hit blocked by Country Blocking on the Live Traffic page for a country that you have not blocked, it is likely an IP address that has recently changed and been updated in one database, but not in the other one yet. While the correct detection of the country where an IP address is located is over 99% accurate, there can be some IP addresses that are identified incorrectly. Wordfence uses a geolocation database that is bundled into the plugin for the country blocking feature. Country Blocking Accuracy, Updates, and Effects of Caching When you use the country blocking feature, you need to decide whether you want to block certain countries from accessing your whole site or from just the login page.Īdvanced country blocking options are found via the “Blocking Options” link under the “Blocking” tab on the “Firewall” page. In This Article Selecting which pages to block access to Selecting countries to block Advanced Country Blocking Options

Ip2location block country