About this plugin
DevDome Country Blocker is a geo blocker for WordPress with country block and allow lists. Block visitors by country or allow only listed countries, subject to your safety exemptions. Blocked visitors get a 403 page with your text or a redirect to another website.
Geo blocking uses verified Cloudflare country headers or the free local DB-IP country database for GeoIP detection. The local database supports IPv4 and IPv6, with automatic monthly refresh. Country detection runs on your server without external lookup requests during visits.
Before you geoblock visitors, use Test Mode to let everyone through and log requests that would be blocked. You can restrict by country while keeping individual IPv4 and IPv6 addresses or CIDR ranges exempt through Always Allowed Addresses. wp-admin is never blocked, and visitors whose country is unknown are always allowed.
How It Knows the Country
- Cloudflare: reads the country header only after checking that the connecting address belongs to a Cloudflare edge range.
- Local database: download the free DB-IP country database with one click in Settings. It supports IPv4 and IPv6. Lookups run on your server, with automatic monthly refresh through a daily scheduled check.
- CloudFront or Vercel: reads their country header only after you turn on Proxy Headers. Use it only when the site really runs behind one of them.
- Your own proxy or load balancer: enter its addresses under Trusted Proxies. The plugin reads X-Forwarded-For only when the connection comes from a listed proxy.
Try Before You Block
Turn on Test Mode to let everyone through and log requests that would be blocked. Test hits are marked “Test” and do not increase blocked totals.
Your Connection on the Overview shows your country, detection source, installed database month and address.
Keep Access to Your Site
- wp-admin is never blocked.
- Login blocking is optional. A settings save is refused if it would block the saving visitor’s detected country from the login page without an allowed address.
- Logged-in users are exempt from front-end blocking by default.
- Always Allowed Addresses accepts individual addresses and CIDR ranges, for IPv4 and IPv6.
- Unknown countries are always allowed.
- Add define('DEVDCOUN_DISABLE', true); to wp-config.php to switch all blocking off.
Optional Login and XML-RPC Blocking
php with separate settings. Both are off by default. Always Allowed Addresses still applies.
Logged-in and crawler exemptions do not apply to these endpoints.
Search Engines and Health Checks
One checkbox exempts Google, Bing, DuckDuckGo and Apple crawlers, plus the DevDome health monitor, from front-end blocking. It matches their user-agent strings.
Review Blocked Visits
Overview tiles show blocked requests today, over 7 and 30 days, and the number of listed countries. Top Blocked Countries shows counts over 30 days.
The log keeps about the last 200 hits, including Test Mode hits. It shows time, country, result, anonymized address, path without its query string, and user agent.
Use Refresh Now to recalculate the totals. Clear Statistics removes every counter and logged hit after you type CLEAR.
Limits
Blocking applies only to requests that reach WordPress. A full-page cache or CDN can serve a cached page before the plugin runs.
php and REST API requests are not blocked. The user-agent exemption can be faked. On multisite, each site has separate settings, country lists and statistics, so set up each site separately.
AI Agents and MCP
9+, the plugin registers 8 abilities: get-status, get-settings, update-settings, get-statistics, lookup-country, update-database, refresh-summary and clear-statistics. Compatible agents and MCP clients can use them through the WordPress MCP Adapter. Every ability requires the plugin capability, manage_options by default.
Older WordPress versions register none.
Agents must pass confirm: true after the owner agrees to:
- Download or update the database, or clear statistics.
- Enable login or XML-RPC blocking.
- Change who is blocked when either the current or proposed mode is not Off and its country list is nonempty. This includes mode, active country list, Test Mode, login/XML-RPC settings, logged-in or crawler exemptions, proxy settings and allowed addresses. Changes that reduce blocking also need confirmation.
This settings rule applies even in Test Mode. Changing only the message, redirect or response action does not require confirmation. Agent output never carries full visitor addresses, email addresses or server paths.
External services
com ), only when you press “Download Database” in Settings (or “Update Database Now”, shown there after a failed monthly update), when an agent runs update-database, and afterwards by a daily check that downloads again only when a newer monthly dataset is due (or the last attempt failed). com/free/ (about 10 MB, server-to-server). It is a plain file download: no visitor data, site data or personal data is sent.
If you never install the database (for example because your site is behind Cloudflare), nothing is ever downloaded. Service provider: DB-IP. 0.
php
com ), only when you press “Report this error” on an error message. com/api/plugin/error-report. Nothing is sent unless you press the button.
Service provider: DevDome. com/privacy-policy
com ). json at most once every 12 hours (one hour after a failed fetch), so the list stays current. Only the bundled core version is sent in the request; no site or visitor data.
Service provider: DevDome. com/privacy-policy
Country Blocker’s own features (country detection, blocking, statistics) run entirely on your own server and make no network requests during a visit.
The plugin bundles the shared DevDome suite library that powers the DevDome Tools dashboard. org edition nothing is contacted before you act; the self-hosted edition also checks for updates as described below.
WordPress.org edition
org. Besides the requests above (the database download you start, error reports you send, the plugin catalog), the only other request the shared library can make is the optional account connection below.
Connecting a DevDome account (optional, both editions)
The DevDome Tools dashboard offers connecting a free DevDome account (used by other DevDome plugins for optional email alerts; Country Blocker’s own features stay local; the shared library performs only the checks described here). Nothing is sent until you press the Connect button. com/plugin/disconnect when you disconnect.
When you connect from the DevDome Tools dashboard, whose Connect card states this before you press the button, those account checks also carry the slug and version of each active DevDome plugin on the site plus the bundled DevDome library, WordPress and PHP versions, so your DevDome account can show your sites and their DevDome plugins for support and update notices. Nothing about other plugins, users, email addresses, content or visitors is included.
Sites connected before this was introduced, and sites connected from a button that does not show that text, do not send the list. Disconnecting stops the checks and the plugin list. com/terms-of-service.
com/privacy-policy
Self-hosted edition only
- https://api.devdome.com/plugin-updates/devdome-country-blocker.json: the self-hosted update manifest, checked from wp-admin and cron (never on front-end requests), cached six hours, ten-second timeout. The request sends no site data; it is a plain download. The updater validates the manifest and, when it publishes a checksum, verifies the downloaded package before installation; on any failure the installed version keeps working.
- https://api.devdome.com/bot-protection/*: the shared once-daily bot-detection reference lists used by other DevDome plugins. A one-way download; no data about your site or visitors is sent.
Privacy
- Your data stays local. Settings, counters, the hit log and the downloaded database are stored only on your own site and are removed on uninstall.
- Addresses are anonymized before storage. The address field of the log keeps the first three numbers of an IPv4 address and the first 48 bits of an IPv6 address, never the full address. The requested path (without its query string) and the user agent of a blocked request are stored as sent.
- Retention is bounded. About 200 logged hits are kept (trimmed as new hits arrive and exactly once a day); daily counters older than 13 months are removed automatically.
- You can delete everything. “Clear Statistics” removes every counter and every logged hit on demand.
- No cookies are set by this plugin and no visitor data leaves your site.