WordSec
WordSec
Tutorial

How to Block a Country in WordPress (Step by Step)

Most attack traffic comes from countries you never sell to. Here is how to block any country or continent in WordPress for free, without touching code.

WordSec Team
July 21, 20269 min read

Pull up your access logs and check where your traffic actually comes from. For most small and mid-size WordPress sites, a large share of brute-force attempts, card testing, comment spam, and vulnerability scans originates from a handful of countries the site has no business relationship with at all.

Country blocking, also called geoblocking, closes that door. If you run a local business in Germany, there is rarely a reason for thousands of daily requests from the other side of the world to reach your login page. This guide shows how to set it up with the free WordSec plugin, when it is a good idea, and when a lighter approach works better.

Should you block countries at all?

Geoblocking is a blunt tool, and that is exactly why it works. Before turning it on, think about two things:

  • Where are your real visitors? If you sell worldwide, blocking whole countries will cost you customers. In that case, block logins by country instead of the whole site (more on that below).
  • Where do your attacks come from? Check your logs first. Blocking a country you receive zero attacks from achieves nothing.

One honest caveat: a determined attacker can hop on a VPN and appear to come from an allowed country. Geoblocking removes the massive background noise of untargeted bots, and for the smaller group that routes around it, WordSec can block VPN and proxy traffic as a second layer.

Step 1: Install WordSec and open the Blocking module

WordSec ships country and continent blocking in its free plan, while most other security plugins keep geoblocking behind a paid tier.

  1. In your WordPress admin, go to Plugins, Add Plugins and search for WordSec.
  2. Click Install Now, then Activate.
  3. Open the WordSec menu, click Get Key to activate your free license, then open the Blocking module.

The Blocking module is where all IP and geo controls live: single IPs, CIDR ranges, countries, and entire continents.

Step 2: Choose blacklist or whitelist mode

WordSec supports both directions, and picking the right one matters:

  • Blacklist mode blocks the countries you select and allows everyone else. This is the right choice for most sites: keep the world open, shut out the noisy regions.
  • Whitelist mode allows only the countries you select and blocks everyone else. This fits sites with a strictly local audience, for example a restaurant, a clinic, or a regional service business that only ever serves customers from one or two countries.

Whitelist mode is the more aggressive option, so double-check your audience in your analytics before enabling it.

Step 3: Block countries or whole continents

In the Blocking module, add the countries you want to stop. You can select them one by one, or block at the continent level when the pattern is broad. A continent-level rule saves you from maintaining a long country list when your logs show scattered attacks from an entire region.

Every blocked request lands in the banned list with the reason recorded, so you always know why a given IP was stopped.

Start with the two or three countries that dominate your attack logs, watch the results for a week in Live Traffic, then expand. Blocking half the planet on day one usually creates support tickets, not security.

Step 4: Whitelist yourself before anything else

Before you save aggressive rules, add your own IP to the whitelist. WordSec supports an IP whitelist that always wins over geo rules, so you cannot lock yourself out even if your own country ends up in a blocked range while traveling. If your team works remotely, add their IPs or ranges too.

Step 5: Set a custom block message

By default, blocked visitors get a plain denial. WordSec lets you write a custom block message, which is worth two minutes of your time. A short note like "Access from your region is not available. Contact us at ..." turns a confusing dead end into something a mistakenly blocked human can act on.

Step 6: Verify it works in Live Traffic

Now confirm the rules actually bite. Open the Live Traffic module and watch requests in real time. Blocked hits show up as they happen, and you can browse historical traffic to compare the noise level before and after. The Blocking module's banned list gives you the same picture from the other side: every banned IP and CIDR with the reason for the ban.

If the noise drops but a few persistent IPs keep knocking, ban them directly. WordSec lets you block IPs one by one, in bulk, or from an uploaded file.

Alternative: block logins by country, keep the site open

Full geoblocking is not the only option. If you want worldwide readers but a locked-down admin, use the Login Security module instead. It supports whitelisted countries for login, which means anyone can read your content, but only visitors from your chosen countries can even reach the login process.

This is the best fit for blogs, news sites, and shops with international customers: zero impact on real visitors, and the attack surface that matters most, your login, shrinks to a fraction of the planet. Pair it with the steps in How to Stop Brute Force Attacks on WordPress for full coverage.

Round it out with automatic abuse protection

Geo rules stop regions. For everything that still gets through, the Blocking module adds automatic layers worth enabling while you are there:

  • 404 and 403 abuse protection bans IPs that generate floods of not-found or forbidden responses, a classic scanner fingerprint.
  • Rate limiting throttles clients that hammer your site faster than any human browses.

Together with the firewall itself, covered in How to Set Up a WordPress Firewall (WAF), these layers catch abusive behavior no matter where it comes from.

A quick recap

To block a country in WordPress:

  1. Install WordSec and open the Blocking module.
  2. Pick blacklist mode (block selected countries) or whitelist mode (allow selected countries).
  3. Add countries or whole continents.
  4. Whitelist your own IPs first.
  5. Write a custom block message.
  6. Watch Live Traffic and the banned list to confirm the effect.
  7. Prefer login-only country rules if you have an international audience.

Frequently asked questions

Is country blocking free in WordSec?

Yes. Country and continent blocking, IP and CIDR bans, rate limiting, and 404/403 abuse protection are all part of the free plan. Most competing plugins sell geoblocking as a premium feature, as you can see in the feature comparison.

Will blocking countries hurt my SEO?

Not if you stay away from the regions search engines crawl from. Googlebot crawls primarily from the United States, so blocking the US would be a serious mistake for SEO. Blocking countries your business does not serve, and that host mostly bot traffic toward you, has no negative ranking effect.

Can attackers bypass geoblocking with a VPN?

Some can, and the untargeted majority never bothers. Geoblocking removes the bulk noise. For the rest, WordSec Premium adds toggles to block VPN, proxy, and Tor exit IPs, which closes the workaround too.

Should I block the whole site or only the login?

Local-only businesses can block the whole site. Anyone with international readers or customers should use the login country whitelist in the Login Security module instead, so content stays reachable while the admin does not.

Does geoblocking slow my site down?

No. WordSec evaluates blocking rules early in the request, before WordPress does its heavy lifting, so blocked requests consume less of your server, not more. Sites under bot floods usually get faster after enabling it.

Cut the noise today: install WordSec, enable geoblocking in the Blocking module, and then work through the WordPress Security Checklist 2026 to cover the rest.

Back to all posts