XeroWP
HULO Geo-block
HULO Geo-block

HULO Geo-block

0/5 (0 ratings) — active installs Updated Nov 4, 2026
country blockinggeo blockinggeolocationip allowlistmaintenance mode
Download v0.1.1 Plugin Website
HULO → Geo-block, Rules tab: region presets that stack, the plain-English summary of what the rules do, and the dismissible Pro box.

HULO → Geo-block, Rules tab: region presets that stack, the plain-English summary of what the rules do, and the dismissible Pro box.

HULO Geo-block decides, before WordPress runs its main query, whether a visitor may use your site. Allowed visitors are untouched; refused visitors see a branded block page or are redirected.

Works on any WordPress site. If you take payments with the free HULO Payments plugin, payments from blocked visitors are refused before they are charged.

Rules

  • Region presets: Worldwide, United Kingdom only, European Union, North America and Oceania.
  • Extra allowed countries and always-blocked countries (for example “the EU except one country”, or “worldwide except a few”).
  • A live, plain-English summary of what the rules do, and a warning before you save rules that would block everyone.

Never locks you out

  • Administrators are never blocked.
  • wp-admin, the login page, cron, AJAX, the REST API, XML-RPC, payment-gateway callbacks (wc-api), robots.txt and sitemaps are never blocked.
  • IP allowlist with IPv4 and IPv6 addresses and CIDR ranges, plus a one-click “Add my IP”.

SEO-safe

  • Well-known search and link-preview crawlers (Googlebot, Bingbot, DuckDuckBot, Applebot, Facebook, LinkedIn, Slack, WhatsApp and more) are let through by default, so a country restriction does not drop your site out of search results. Permissive, custom and off modes are available.
  • Crawlers may only browse. A User-Agent can be faked, so add-to-cart, checkout and payments are never exempt.
  • Optional reverse-DNS verification of Googlebot and Bingbot: a visitor claiming to be one is checked against googlebot.com / search.msn.com before it is let through.
  • Block pages send noindex; closures (business hours, maintenance) send HTTP 503 with Retry-After so search engines treat them as temporary.

Business hours and maintenance

  • A weekly opening window in any time zone, including overnight windows and daylight saving.
  • A one-off maintenance window with its own allowed IPs.

Geolocation without external calls

  • Cloudflare CF-IPCountry (and cf-region-code), Akamai and Fastly country headers, once you tell the plugin the site is behind that CDN. Any visitor can send these headers, so they are honoured only for requests arriving from a trusted proxy: Cloudflare’s published ranges (one tick) or the addresses you list (or the HULO_TRUSTED_PROXIES constant).
  • Web-server GeoIP modules (GEOIP_COUNTRY_CODE, MM_COUNTRY_CODE).
  • This plugin never calls a geolocation API. If no source is available yet, the settings page says so and visitors with an unknown country are allowed.
  • A full country list ships with the plugin.
  • Proxy-aware visitor IP: by default only the connecting address is used. Forwarding headers you tick are read only from trusted proxies, and for X-Forwarded-For the right-most address that is not one of your proxies is taken.

Cache-safe

  • Only refused responses are changed, and they are sent with no-store and DONOTCACHEPAGE, so no page cache stores a block page.
  • Optional page-cache helper: if a full-page cache serves pages without running WordPress, a small script re-checks the visitor against an uncached endpoint.

Headless storefronts

  • GET /wp-json/hulo-geo-block/v1/check returns the current visitor’s verdict (rate-limited, uncached). A server-side caller can pass the visitor’s country signed with a secret.

With WooCommerce

Geo-block also:

  • refuses add-to-cart, the classic checkout and the Checkout block (Store API) for blocked visitors, on the server, whatever a page cache served;
  • never blocks shop managers;
  • can use the shop’s geolocation, including its MaxMind database integration, as a country source;
  • uses the shop’s translated country names.

Geo-block Pro

The optional Pro add-on adds 32 more region presets (EEA, Schengen, EFTA, GCC, ASEAN, LATAM, APAC, Commonwealth and more), rules for 249 states, provinces and regions in 11 countries, a soft block that lets visitors browse with a notice but not buy, an audit log with blocked-traffic stats and a dashboard widget, a rule simulator and a weekly e-mail report. Try it free for 14 days, no card: huloglobal.com/wordpress-plugins/geo-block.

External services

This plugin does not connect to any external service. Country lookups use request headers set by your CDN or web server or, when WooCommerce is active, its own geolocation. Its MaxMind integration, if you turn it on, downloads the GeoLite2 database from MaxMind itself, under MaxMind’s terms; this plugin never does.

If you turn on “Verify Googlebot and Bingbot by reverse DNS” (off by default), a visitor whose User-Agent claims to be Googlebot or Bingbot has their IP address looked up in DNS (a reverse lookup, then a forward lookup of the returned host name) through your server’s own DNS resolver. The answer is cached for a day. Only the visitor’s IP address is involved; no data is sent to Google, Microsoft or HULO.