Practical guides on websites, online stores, and getting found on Google — written for business owners, not developers.
Tell us about your business today — get a free quote within 24 hours. No pressure, no confusing tech talk.
Tell us about your business today — get a free quote within 24 hours. No pressure, no confusing tech talk.
Block unwanted IPs, countries, and regions in WordPress the right way — .htaccess, nginx, plugins, and Cloudflare, with a decision table for each.
Something is hammering your login page from the same six countries every night. A handful of IP addresses keep leaving spam in your comments. You delete it. It comes back the next day. Or a client's site just got hit. You want the repeat offenders locked out while you finish the cleanup.
Blocking an IP, a country, or a region can fix any of these. It won't replace a firewall. It won't replace updated plugins or a backup. Think of it as one layer, not the whole plan.
This guide covers all three levels. It shows you how to pick the right method for each situation.
Blocking is not about paranoia. Most site owners do it for one of five reasons.
Stop a repeat attacker or spam source. The same IP keeps hitting your login page or spamming your comments. Blocking it ends that immediately.
Meet a legal or licensing rule. Some products or content can't legally be sold or shown in certain countries.
Cut traffic from markets you'll never sell to. If your business serves one country, most visitors from elsewhere are bots or scrapers, not customers.
Reduce server load. Every blocked request is one less thing your hosting has to handle.
Protect one page, not the whole site. A checkout or lead form getting spammed from one region rarely needs a full block.
None of this happens in a vacuum. If you want the fuller picture of how sites end up on an attacker's radar in the first place, see Why WordPress Websites Get Hacked and Why Owners Find Out Months Later.
Blocking has real limits. Know them before you rely on it.
Country blocks are not precise. IP ranges cross borders. Block China's country code and you can catch parts of Hong Kong or Taiwan too.
VPNs and proxies defeat it instantly. A blocked visitor switches IP and gets back in within seconds. Dynamic IPs make this worse. The address you blocked yesterday might belong to someone else today.
Blocking also has no memory of intent. A crawler like Googlebot might come from an unexpected range. So might an uptime monitor or a payment provider's webhook. Any of those going dark breaks something you actually need.
None of this makes blocking useless. It makes it one layer. Pair it with updates, a firewall, and backups. Never use it instead of them.
Before you block anything, find out who's actually knocking.
Check your security plugin's firewall log first. It shows every blocked and allowed request, with the IP and country attached. No plugin? Pull the raw access logs from your hosting control panel instead. They list every visitor by IP.
Google Analytics and Search Console help too. Look at the geography report. A sudden spike from one country you don't sell to is a signal worth checking.
One rule matters most. Don't block on a single hit. A visitor showing up once is normal. The same IP hitting your login page fifty times in an hour is not. For a deeper walkthrough of reading those logs during an active incident, see WordPress Site Hacked? How to Investigate the Attack Before You Clean It.
Seven ways exist to block an IP, a country, or a region in WordPress. They don't all work the same way.
Some block traffic before it reaches your server. Others let the request in, then WordPress decides what to do with it. That difference matters for performance and for how much technical access you need.
Use the table below to find your starting point, then jump to that method's section.
Method | Where it blocks | Skill level | Best for |
|---|---|---|---|
WordPress Discussion settings | Inside WordPress, comments only | No code | Pure comment spam |
| Before WordPress loads | Basic code | Full site block, most shared hosting |
nginx config | Before WordPress loads | Server access needed | VPS or managed nginx hosting |
PHP snippet | Inside WordPress, early | Basic code | No server file access, any host |
Security plugin | Inside WordPress | No code | Country/region blocking, non-technical owners |
Hosting-level (cPanel/Plesk) | Before it reaches WordPress | No code, panel access needed | Site-wide block when you manage the server |
Cloudflare WAF | Before it reaches your host at all | No code | Performance and security together |
If you're not sure where to start, skip to the plugin or Cloudflare methods first. Both are safer to test than editing server files directly.
Go to Settings > Discussion. Scroll to Disallowed Comment Keys. Paste in the IP addresses you want to block, one per line. Save changes.
This method only touches comments. The visitor can still browse your entire site. It won't stop a brute-force attack or block access to wp-admin. For spam that goes beyond a few repeat IPs, see WordPress Spam Protection: Stop Comment, Form and Registration Spam.
.htaccess (Apache/LiteSpeed)Most WordPress hosting runs on Apache or LiteSpeed. The .htaccess file in your site's root folder controls access at the server level, before WordPress even loads.
Back up your current .htaccess file first. One typo here can take your whole site down.
To block a single IP:
Require not ip 192.168.1.1To block an IP range (CIDR):
Require not ip 192.168.1.0/24List multiple IPs on separate lines. Older Apache versions use Deny from instead of Require not ip. Check your Apache version before choosing the syntax. Upload the file back and test immediately from a different device.
The same rule can target a specific path instead of the whole site, such as xmlrpc.php, one of the most commonly probed files on any WordPress install. See What Is XML-RPC in WordPress and Should You Disable It? if you're not sure whether to block it or turn it off entirely.
If your host runs nginx instead of Apache, .htaccess won't work. You need to edit the nginx configuration file directly.
location / {
deny 192.168.1.1;
allow all;
}For a range:
location / {
deny 192.168.1.0/24;
allow all;
}Reload nginx after saving: sudo systemctl reload nginx. You'll need root or sudo access, or a panel like RunCloud or CloudPanel that edits this file for you. Most shared hosting won't give you this access at all. Ask your host to add the rule, or use a plugin instead.
Some hosts don't give you access to .htaccess or nginx config. A PHP snippet works regardless of which server software you're on, because it runs inside WordPress itself.
Add this near the top of wp-config.php, before the "That's all, stop editing!" line:
$blocked_ips = array('192.168.1.1', '203.0.113.5');
if (in_array($_SERVER['REMOTE_ADDR'], $blocked_ips)) {
header('HTTP/1.1 403 Forbidden');
die('Access denied.');
}A must-use plugin is cleaner than editing wp-config.php directly, since it survives a WordPress update untouched. Create a file in wp-content/mu-plugins/ and paste the same code, wrapped in a plugin comment header.
This method checks the IP after the request reaches your server, so it's slightly heavier than .htaccess or nginx. For a handful of IPs, that difference is invisible.
For countries or regions, a plugin is usually the better choice. Editing server files for geo-blocking means maintaining IP-to-country lists yourself, and those change constantly.
Wordfence, MalCare, and All In One Security all offer country blocking from the dashboard. Pick the countries, save, done. No code involved.
This is also where "region" becomes more than a synonym for "country." Some plugins let you block groups like the EU or APAC in one click, instead of picking each country individually. A few, like IP2Location Country Blocker, go further and support state or province-level blocking.
Check what your plan includes before you rely on this. Country blocking is a free feature in some plugins and a paid upgrade in others.
If you manage your own server or your host gives you panel access, block before WordPress ever loads.
In cPanel, look for IP Blocker under the Security section. Add the IP or range, and cPanel handles the rest at the server level. Plesk has an equivalent tool under IP Address Banning.
This method is fast and doesn't touch any WordPress or code files. If you're on shared hosting without panel access, ask your host to add the block for you.
Cloudflare blocks traffic before it reaches your host at all. That's the biggest advantage over every other method here. Your server never even sees the request.
Older guides point to a "Firewall Rules" tab. That's outdated. In the current dashboard, go to Security > Security rules > Custom rules.
Create a rule with this expression to block a country:
(ip.src.country in {"KP" "SY"})Set the action to Block. Use two-letter country codes (ISO 3166-1 alpha-2), not full country names.
Cloudflare is free at this level, and it's the fastest method to test and undo. If you're already on Cloudflare for DNS or CDN, start here before touching any server file.
Not every problem needs a full site block. Some only need the login page closed off. Others just need one form protected.
Use this to decide:
Situation | What to block | Method to use |
|---|---|---|
Brute-force attempts on wp-login.php | Login page only | nginx/.htaccess location rule, or a login-protection plugin |
Comment spam from a handful of IPs | Comments only | Discussion settings |
A checkout or lead form spammed from one region | That page only | Plugin or PHP snippet |
A country with zero business relevance sending heavy bot traffic | Whole site | Plugin, Cloudflare, or hosting-level |
A client site under active attack, right now | Whole site, immediately | Cloudflare (fastest to deploy and undo) |
Block the smallest thing that solves the actual problem. A full site block is the easiest to set up. It's also the easiest to get wrong, and the hardest to notice once it starts catching legitimate visitors too. For the full picture on stopping brute-force attempts beyond just blocking IPs, see How to Protect WordPress from Brute Force Attacks.
Numbers make this concrete. On one WooCommerce site we manage, the firewall blocked roughly 1,100 requests from other countries in a single week. That's a 23% block rate. Eighteen countries ended up on the block list, out of 249 tracked worldwide.
The top offenders were nowhere near the site's actual customers: Mexico, Argentina, Venezuela, Iraq, Ecuador.
Here's the part worth remembering. The same dashboard once suggested blocking Singapore for "suspicious traffic." Singapore is where this site's actual customers are. Following that suggestion would have blocked real buyers to fix a statistic.
Automated recommendations don't know your business. Block the countries you have no presence in. Look hard at everything else. Never accept a suggestion about a country your customers live in.
This is the same site we cover in How We Recovered a Hacked WordPress Site — the firewall numbers here are from its ongoing protection, not the cleanup itself.
Every method here can lock out the wrong person if you rush it. Run through this before you save any rule.
Whitelist your own IP first. Check it at whatismyip.com. Add it to the allow list before you touch the block list.
Test from somewhere else. Open an incognito window or a VPN set to a blocked country. Confirm the rule works the way you expect.
Check Search Console a day or two later. A drop in crawl stats usually means you blocked more than you meant to.
Keep a way back in. Save your host's support contact, or give a second admin access, in case a rule locks you out completely.
One bad rule shouldn't cost you a support ticket to fix. Five minutes of testing prevents that.
Blocking an IP, a country, or a region is a tool, not a strategy. It stops what's in front of you right now. It won't stop what shows up tomorrow from a different address.
Use the smallest block that solves your actual problem. Pair it with updates, a firewall, and backups you actually test. If you're dealing with an active attack right now, or you're not sure which method fits your hosting setup, that's exactly the kind of call a security audit sorts out fast.
No. It stops that specific IP range from reaching your site right now. Attackers switch IPs, use VPNs, or route through a different country within minutes. Treat blocking as a filter, not a lock.
It can, if you're not careful. Search engine crawlers use IP ranges too, and a broad country block can catch one by accident. Always check Search Console after deploying a new rule.
A country block targets one ISO code, like "US" or "BD." A region groups several countries together, such as the EU or APAC, or narrows down to a state or province.
Yes, and it's usually the better choice. An nginx or .htaccess rule scoped to /wp-login.php and /wp-admin/ stops brute-force attempts without touching the rest of your site.
For most site owners, yes. A plugin gives you an interface and an undo button. A typo in a server config file can take the whole site offline until you fix it.
Remove the rule wherever you added it. Delete the line in .htaccess or nginx, deselect the country in your plugin, or remove the Cloudflare rule. Changes take effect within seconds.
SEO & Security Expert, AppDeel
Azizul Hakim is an SEO and website security specialist at AppDeel, the agency he founded and where he still handles client work himself. For more than ten years he has helped business owners and eCommerce brands get found in search and keep their websites secure.
Read more posts by Md Azizul Hakim →Comment spam, form spam and fake registrations all cost you time, leads and security. Here's a business owner's guide to stopping WordPress spam for good.
A brute force attack is a hacker's program trying login after login, thousands or millions of combinations, until one works.
XML-RPC still runs on most WordPress sites by default. See what it does, who still needs it, and a clear answer on when to disable it safely.
Nulled WordPress themes and plugins ship with malware and backdoors built in. Here are 12 real reasons to avoid them, with the data behind each one.
Tell us about your business today — get a free quote within 24 hours. No pressure, no confusing tech talk.