Some sites simply do not need worldwide traffic — or keep getting spam registrations and brute-force login attempts from countries they never do business with.

Wonderful Geoblocking Countries lets you block three areas of your site independently, each with its own country list and its own message:

Site access — the whole public frontend.
Login — the wp-login.php page.
Registration — the user registration form.

For every area you pick the mode that fits:

Block list — block visitors from the selected countries and allow everyone else.
Allow list — allow only the selected countries and block everyone else (e.g. “only visitors from Austria, Germany and Switzerland may log in”).

On top of that, every area can also block visitors who use a VPN service — regardless of which country their VPN server is in. Without this, anyone could get around a country rule with a VPN.

Blocked visitors receive an HTTP 403 response with your custom message (basic HTML allowed).

Built-in safety rails:

Logged-in administrators are never geoblocked, so you cannot lock yourself out of a site you are logged in to.
The WordPress admin and the login page are never affected by the site access rule — login blocking is its own explicit setting.
Visitors whose country cannot be determined are never blocked.

Two free data sources, stored on your server:

Country database (required) — the free IP2Location LITE country database (IPv4 + IPv6). It is not bundled: you create a free account at lite.ip2location.com, paste your personal download token into the settings, and the plugin downloads the database (a few MB) onto your server. It refreshes itself about once a month.
VPN list (optional) — the IP ranges of the common VPN providers, combined from three free sources because none of them is complete on its own: the X4BNet VPN list (MIT license), the VPN server lists of antonme/ipranges (CC0, taken from the providers’ own server feeds), and all networks of pure VPN operators via RIPEstat. iCloud Private Relay is removed from the list — it hides ordinary iPhone users and is no VPN service. Switch it on with one checkbox — no account or token needed. The plugin downloads it onto your server and refreshes it every week. Only needed if you use the VPN option of an area.

Both updates run automatically and can be switched off at any time; the Download / update databases now button fetches both at once.

Sites behind a CDN or reverse proxy can feed the real visitor IP (or a ready-made country code, e.g. from Cloudflare’s CF-IPCountry header) into the plugin via the wonderful_geoblocking_countries_client_ip and wonderful_geoblocking_countries_pre_country_code filters.

This plugin uses IP2Location LITE data available from https://lite.ip2location.com. The optional VPN list is built from data by X4BNet (https://github.com/X4BNet/lists_vpn, MIT license), antonme/ipranges (https://github.com/antonme/ipranges, CC0) and RIPE NCC RIPEstat (https://stat.ripe.net/).

External services

This plugin connects to three external services. All of them are only contacted to download data files onto your server; no data about your visitors is ever transmitted.

IP2Location (country database). The plugin downloads the IP2Location LITE geolocation database from www.ip2location.com. The download only happens when you actively configure it: you enter your personal download token and click the download button (afterwards a monthly scheduled refresh re-downloads the database with the same token). The token you obtained from your lite.ip2location.com account is sent to www.ip2location.com as part of the download request. This service is provided by IP2Location.com: terms of use, privacy policy.

GitHub (VPN list, optional). Only if you enable the VPN list, the plugin downloads the text files of the X4BNet VPN list (https://github.com/X4BNet/lists_vpn) and the VPN and iCloud Private Relay lists of antonme/ipranges (https://github.com/antonme/ipranges) from raw.githubusercontent.com — when you click the download button and then once a week. The request contains no personal data besides the usual technical connection data (your server’s IP address). This service is provided by GitHub, Inc.: terms of service, privacy statement.

RIPEstat (VPN list, optional). Only if you enable the VPN list, the plugin asks the RIPEstat Data API (stat.ripe.net) for the IP prefixes announced by a few networks that are run only for VPN servers — at the same times as the GitHub download. The request contains only the network number (e.g. AS147049) and no personal data besides the usual technical connection data (your server’s IP address). This service is provided by RIPE NCC: terms of service, privacy statement.

All lookups for your visitors (country and VPN) happen locally on your server against the downloaded files — visitor IP addresses never leave your site.