描述
Some sites simply do not need worldwide traffic — or keep getting spam registrations and brute-force login attempts from countries they never do business with.
Wonderful Geoblocking Countries lets you block three areas of your site independently, each with its own country list and its own message:
- Site access — the whole public frontend.
- Login — the wp-login.php page.
- Registration — the user registration form.
For every area you pick the mode that fits:
- Block list — block visitors from the selected countries and allow everyone else.
- Allow list — allow only the selected countries and block everyone else (e.g. “only visitors from Austria, Germany and Switzerland may log in”).
On top of that, every area can also block visitors who use a VPN service — regardless of which country their VPN server is in. Without this, anyone could get around a country rule with a VPN.
Blocked visitors receive an HTTP 403 response with your custom message (basic HTML allowed).
Built-in safety rails:
- Logged-in administrators are never geoblocked, so you cannot lock yourself out of a site you are logged in to.
- The WordPress admin and the login page are never affected by the site access rule — login blocking is its own explicit setting.
- Visitors whose country cannot be determined are never blocked.
Two free data sources, stored on your server:
- Country database (required) — the free IP2Location LITE country database (IPv4 + IPv6). It is not bundled: you create a free account at lite.ip2location.com, paste your personal download token into the settings, and the plugin downloads the database (a few MB) onto your server. It refreshes itself about once a month.
- VPN list (optional) — the free X4BNet VPN list (MIT license) with the IP ranges of the common VPN providers. Switch it on with one checkbox — no account or token needed. The plugin downloads it (about 200 KB) onto your server and refreshes it every week. Only needed if you use the VPN option of an area.
Both updates run automatically and can be switched off at any time; the Download / update databases now button fetches both at once.
Sites behind a CDN or reverse proxy can feed the real visitor IP (or a ready-made country code, e.g. from Cloudflare’s CF-IPCountry header) into the plugin via the wonderful_geoblocking_countries_client_ip and wonderful_geoblocking_countries_pre_country_code filters.
This plugin uses IP2Location LITE data available from https://lite.ip2location.com. The optional VPN list is provided by X4BNet (https://github.com/X4BNet/lists_vpn) under the MIT license.
External services
This plugin connects to two external services. Both are only contacted to download data files onto your server; no data about your visitors is ever transmitted.
IP2Location (country database). The plugin downloads the IP2Location LITE geolocation database from www.ip2location.com. The download only happens when you actively configure it: you enter your personal download token and click the download button (afterwards a monthly scheduled refresh re-downloads the database with the same token). The token you obtained from your lite.ip2location.com account is sent to www.ip2location.com as part of the download request. This service is provided by IP2Location.com: terms of use, privacy policy.
GitHub (VPN list, optional). Only if you enable the VPN list, the plugin downloads the two text files of the X4BNet VPN list (ipv4.txt and ipv6.txt from https://github.com/X4BNet/lists_vpn) from raw.githubusercontent.com — when you click the download button and then once a week. The request contains no personal data besides the usual technical connection data (your server’s IP address). This service is provided by GitHub, Inc.: terms of service, privacy statement.
All lookups for your visitors (country and VPN) happen locally on your server against the downloaded files — visitor IP addresses never leave your site.
屏幕截图
安装
- Upload the
wonderful-geoblocking-countriesfolder to the/wp-content/plugins/directory. - Activate the plugin through the ‘Plugins’ menu in WordPress.
- Create a free account at lite.ip2location.com and copy your download token.
- Go to Settings > Geoblocking Countries, paste the token, save, and click Download / update database now.
- Optional: tick VPN list, save, and download again to also block VPN users.
- Pick the countries to block per area (and tick VPN where you want to block VPN users), write your block messages, done!
常见问题
-
Why is the geolocation database not included in the plugin?
-
The IP2Location LITE database is free but published under its own license that requires every user to register for their own copy. The download with your personal token takes less than a minute and enables automatic monthly updates.
-
What happens while no database is installed?
-
Nothing — no visitor is blocked. The plugin shows an admin notice until a database is installed, and visitors whose country cannot be determined are always let through.
-
Can I lock myself out?
-
Not while you are logged in: administrators are always exempt from all three rules. Only the login rule can affect you when you are logged out and your own country is on its list — the settings page warns you about exactly that.
-
My site runs behind Cloudflare or another proxy — the detected country is wrong.
-
Behind a proxy,
REMOTE_ADDRis the proxy’s address, not the visitor’s. Use thewonderful_geoblocking_countries_client_ipfilter to supply the real client IP from a header you trust, or short-circuit the lookup entirely withwonderful_geoblocking_countries_pre_country_code(e.g. return the value of Cloudflare’sCF-IPCountryheader). -
Does blocking also apply to the REST API and feeds?
-
The site access rule runs on every frontend request, including feeds and the REST API. The WordPress admin (including admin-ajax) and wp-login.php are excluded from it.
-
How does VPN blocking work, and how reliable is it?
-
Tick VPN list under Databases and download it, then tick VPN in every area where VPN users should be blocked. A visitor whose IP lies in a range of a known VPN provider is then blocked — regardless of the country and even in allow-list mode (otherwise a VPN server in an allowed country would be a way in).
The X4BNet list covers the IP ranges of the common commercial VPN providers and is updated daily. No free list catches every VPN, though: small or self-hosted VPNs, Tor and residential proxies are usually not included. Logged-in administrators are never blocked, VPN or not.
-
Why not the IP2Proxy LITE database?
-
We tried it: the free IP2Proxy LITE edition only lists open public proxies — no VPN servers and no Tor exits (those are reserved for the paid edition) — and is more than 1 GB in size. The X4BNet list is a few hundred KB and actually recognises VPN providers.
-
Can other plugins use the VPN list?
-
Yes. Once the VPN list is installed:
$is_vpn = apply_filters( 'wonderful_geoblocking_countries_is_vpn_ip', null, $ip );It returns
trueorfalse, and the default (null) while the VPN list is disabled or not installed. -
Is any visitor data sent to a third party?
-
No. Country lookups run locally against the downloaded database file. The only external request is the database download itself, which you trigger with your own token.
评价
此插件暂无评价。
贡献者及开发者
更新日志
1.1.0
- Added: VPN blocking. Every area (site access, login, registration) can now also block visitors who use a VPN service, regardless of their country. It uses the free X4BNet VPN list (optional, about 200 KB, no token needed), which the plugin downloads onto your server and refreshes every week.
- Added:
wonderful_geoblocking_countries_is_vpn_ipfilter so other plugins can reuse the VPN list. - Improved: the database section of the settings page is clearer — the required country database and the optional VPN list each show their own status, and one button updates both.
- Improved: the settings page shows whether your current IP is on the VPN list.
- Improved: downloaded databases are validated before they replace the installed file, and archives are unpacked without loading them into memory.
1.0.3
- Fixed: the 1.0.2 release package was missing the bundled Select2 library (the build skipped the production dependencies), so the country lists on the settings page rendered as plain multi-select boxes. The build process now always ships it.
- Improved: mode, countries and block message of each area are now collapsible on the settings page — expanded while the area is enabled, collapsed otherwise (still one click away, so you can configure an area before switching it on). The page is much easier to read.
- Tested up to WordPress 7.1.
1.0.2
- Updated the bundled Select2 library from the 4.1.0 release candidate to the stable 4.1.0 release (now managed via Composer).
- Fixed the IP2Location terms-of-use link in the readme.
- Corrected the “Tested up to” header to a major.minor WordPress version.
1.0.1
- Added a
wonderful_geoblocking_countries_country_for_ipfilter so other plugins can reuse the IP2Location country lookup.
1.0.0
- Initial release.