HULO Geo-block

HULO Geo-block decides, before WordPress runs its main query, whether a visitor may use your site. Allowed visitors are untouched; refused visitors see a branded block page or are redirected.

Works on any WordPress site. With WooCommerce it also refuses add-to-cart and checkout (classic checkout and the Checkout block) for blocked visitors, uses WooCommerce’s MaxMind geolocation, and with HULO Payments it refuses payments from blocked visitors.

Rules

• Region presets: Worldwide, United Kingdom only, European Union, North America and Oceania.

• Extra allowed countries and always-blocked countries (for example “the EU except one country”, or “worldwide except a few”).

• A live, plain-English summary of what the rules do, and a warning before you save rules that would block everyone.

Never locks you out

• Administrators (and, with WooCommerce, shop managers) are never blocked.

• wp-admin, the login page, cron, AJAX, the REST API, XML-RPC, payment-gateway callbacks ( wc-api ), robots.txt and sitemaps are never blocked.

• IP allowlist with IPv4 and IPv6 addresses and CIDR ranges, plus a one-click “Add my IP”.

SEO-safe

• Well-known search and link-preview crawlers (Googlebot, Bingbot, DuckDuckBot, Applebot, Facebook, LinkedIn, Slack, WhatsApp and more) are let through by default, so a country restriction does not drop your store out of search results. Permissive, custom and off modes are available.

• Crawlers may only browse. A User-Agent can be faked, so add-to-cart, checkout and payments are never exempt.

• Optional reverse-DNS verification of Googlebot and Bingbot: a visitor claiming to be one is checked against googlebot.com / search.msn.com before it is let through.

• Block pages send noindex; closures (business hours, maintenance) send HTTP 503 with Retry-After so search engines treat them as temporary.

Business hours and maintenance

• A weekly opening window in any time zone, including overnight windows and daylight saving.

• A one-off maintenance window with its own allowed IPs.

Geolocation without external calls

• Cloudflare CF-IPCountry (and cf-region-code ), Akamai and Fastly country headers, once you tell the plugin the site is behind that CDN. Any visitor can send these headers, so they are honoured only for requests arriving from a trusted proxy: Cloudflare’s published ranges (one tick) or the addresses you list (or the HULO_TRUSTED_PROXIES constant).

• Web-server GeoIP modules ( GEOIP_COUNTRY_CODE, MM_COUNTRY_CODE ).

• With WooCommerce: its own geolocation, including its MaxMind database integration.

• This plugin never calls a geolocation API. If no source is available yet, the settings page says so and visitors with an unknown country are allowed.

• A full country list ships with the plugin; with WooCommerce its translated list is used.

• Proxy-aware visitor IP: by default only the connecting address is used. Forwarding headers you tick are read only from trusted proxies, and for X-Forwarded-For the right-most address that is not one of your proxies is taken.

WooCommerce and HULO Payments (optional)

• With WooCommerce active, add-to-cart, the classic checkout and the Checkout block (Store API) refuse blocked visitors on the server, whatever a page cache served.

• With HULO Payments active, payments from blocked visitors are refused before they are charged.

Cache-safe

• Only refused responses are changed, and they are sent with no-store and DONOTCACHEPAGE, so no page cache stores a block page.

• Optional page-cache helper: if a full-page cache serves pages without running WordPress, a small script re-checks the visitor against an uncached endpoint.

Headless storefronts

• GET /wp-json/hulo-geo-block/v1/check returns the current visitor’s verdict (rate-limited, uncached). A server-side caller can pass the visitor’s country signed with a secret.

Geo-block Pro

The optional Pro add-on adds 32 more region presets (EEA, Schengen, EFTA, GCC, ASEAN, LATAM, APAC, Commonwealth and more), rules for 249 states, provinces and regions in 11 countries, a soft block that lets visitors browse with a notice but not buy, an audit log with blocked-traffic stats and a dashboard widget, a rule simulator and a weekly e-mail report. com/wordpress-plugins/geo-block.

External services

This plugin does not connect to any external service. Country lookups use request headers set by your CDN or web server, or, when WooCommerce is active, WooCommerce’s own geolocation.

If you turn on “Verify Googlebot and Bingbot by reverse DNS” (off by default), a visitor whose User-Agent claims to be Googlebot or Bingbot has their IP address looked up in DNS (a reverse lookup, then a forward lookup of the returned host name) through your server’s own DNS resolver. The answer is cached for a day. Only the visitor’s IP address is involved; no data is sent to Google, Microsoft or HULO.

If you enable WooCommerce’s MaxMind integration, WooCommerce itself downloads the GeoLite2 database from MaxMind under MaxMind’s terms; that is part of WooCommerce, not this plugin.