IPGeolocation.io – Geo Redirects & Content Control

io – Geo Redirects & Content Control decides what each visitor sees based on where they are and what IP address they are using.

You can send people from one country to a different page, keep unwanted IP addresses away from your site or your login page, and show or hide parts of a page depending on the visitor’s location. Everything is set up from one settings screen, and you do not need to write any code.

io API to work out a visitor’s country and other details. Results are stored for 24 hours per address, so your site stays fast.

Main Features

• Country-based redirects (entire site, specific pages, or URL patterns)

• Optional popup confirmation before redirect

• IP address blocking, with separate rules for your website and your login page

• Address lists that accept single addresses, ranges, wildcards, IPv4 and IPv6

• Safe list of addresses that are never blocked by any rule

• Protection against locking yourself out, with a recovery option

• Country-level access control (allow or block)

• Conditional content shortcodes

• Output visitor geolocation data via shortcode

• Page and query-string exclusions

• Redirect bypass and reset via URL parameters

• Bot detection (search engines and social crawlers excluded from redirects)

• Administrator-safe (admins are never redirected)

• IP response caching using WordPress transients

Blocking Visitors By IP Address

The IP section asks two questions, and you answer them separately:

• Who can visit your website

• Who can reach your login page

For each one, you can leave it open to everyone, block a list of addresses, or allow only a list of addresses. Locking the login page to your office address is a simple way to stop password guessing bots, and ordinary visitors are not affected at all.

IP rules are checked before any location lookup, so blocking somebody uses none of your API credits.

Configuration

io:

• Developer (Free)

• Paid

On a Paid plan you can also turn on Include security data under Plan Type. It adds proxy, VPN, Tor and threat score details to each lookup and uses extra API credits. Only the security shortcode fields need it; country redirects and access control do not.

Blocking by IP address does not need an API key. Everything based on country does.

Shortcodes

Display Single Geolocation Field

[ipgeo country] [ipgeo city] [ipgeo country_code]

Available fields include:

ip, city, state, country, country_code, zipcode, continent, latitude, longitude, currency, calling_code, languages, is_proxy, is_tor, is_anonymous, cloud_provider

Conditional Content (Show If Match)

[/ipgeo_if]

Supported attributes: country, country_code, state, city, continent, is_proxy, is_tor, is_cloud_provider, is_anonymous, logic (AND / OR)

Conditional Content (Hide If Match)

[/ipgeo_if_not]

Both shortcodes accept the same attributes, so you can hide content from one country just as easily as showing it to another.

Redirect Bypass

For testing or user control, redirects can be bypassed:

geo_bypass=1 bypasses redirects for 30 days. Use it in links that let visitors choose this site, for example a “Visit our international store” link on your other site

geo_reset=1 forgets everything the plugin remembers about the visitor: earlier redirects, popup answers and bypasses

Both are removed from the address bar once read, so they do not end up in shared links.

This does not affect IP rules.

External Services Used

This plugin connects to two outside services.

io

Used to find the country, region, city and security details for a visitor’s IP address. This powers country redirects, country access control and the shortcodes.

io/v3/ipgeo when a page needs location data. Results are stored for 24 hours per address, so a returning visitor does not cause a second request. Nothing is sent if you have not entered an API key, and nothing is sent for a visitor already blocked by an IP rule.

An API key is required. io. Without it, the country-based features will not work.

html

html

Cloudflare

Used only to keep an up-to-date list of Cloudflare server addresses. The plugin needs this list to tell whether a Cloudflare header can be trusted. Without it, that header could be faked by anyone.

com/ips-v6. No visitor information, site information or personal data is sent. If the request fails, a copy included with the plugin is used instead.

This only happens when address detection is set to Automatic or Cloudflare.

com/website-terms/

com/privacypolicy/

License

This plugin is licensed under the GPL v2 or later.