Geo Blocking | SeenSecure Help

Overview

Geo Blocking lets you control which countries can access your WordPress site. Each visit is geolocated by IP using an up-to-date GeoIP database. Depending on your configuration, you can block (Blacklist) or allow (Whitelist) specific countries.

While Attack Protection blocks attack vectors (SQLi, XSS, LFI) and other rules block malicious IPs, Geo Blocking filters by geographic nationality — regardless of whether the IP has a clean record.

⚠️ Depends on the Firewall mode: Geo Blocking does NOT act in isolation. If the general Firewall (Firewall → Mode) is set to Monitor, Learning, or Off, Geo Blocking will only log events, without blocking or challenging anyone, whatever mode you chose here. Challenge/Block only take effect when the general Firewall is in Protection or Strict.

What makes it unique

Filters by country, not by individual IP

Ideal for sites with a known regional audience

Complements other protections without replacing them

When to use it

Regional site that only operates in certain countries

Mass attacks from specific regions

Regulatory compliance (GDPR, local data protection)

data-ssc-help: geo_blocking

Strategy: Blacklist vs Whitelist

The first decision is to choose between two mutually exclusive strategies. The one you pick determines how each visit is evaluated.

Blacklist (Recommended)

Blocks only the countries you select. The rest of the world can access normally.

✅ Ideal for:

Global sites that want to block high-risk regions

Lower risk of blocking legitimate visitors

Whitelist

Only allows the countries you select. Everything else is blocked.

✅ Ideal for:

Sites with a 100% regional audience (e.g., Spain only)

Maximum geographic security

⚠️ Caution with Whitelist: If a legitimate visitor travels abroad or uses a VPN in an unlisted country, they will be blocked. Use Whitelist only if you are sure your audience will never need to access from outside the allowed countries.

Action Modes

Once the strategy is defined, the mode determines how visits that fall within the rules are handled.

📊 Log only

Does not block anything. Logs every visit that would be blocked according to your strategy. It is the option recommended initially, to calibrate your configuration without risk.

🧮 Math Challenge

Shows a page with a simple sum (e.g. 4 + 7 = ?) the visitor must solve to continue. The page responds with HTTP status 429. If they answer correctly, they are let through for 1 hour without being challenged again. If they fail, they can retry.

🚫 Direct Block

Blocks with an "access denied" page (403 Forbidden). No verification or second chance. Only use it once you are sure of your configuration, after validating in "Log only" and "Math Challenge".

🔒 Minimal Block

Just as restrictive as Direct Block (403), but without the branded page: shows only the plain text 403 Forbidden - Geo-Blocking. Useful if you'd rather not show your branding or any detail to blocked traffic.

📋 Recommended workflow: Log only → Math Challenge → Direct Block (or Minimal). Always start with "Log only" and review logs for 48h (remember the general Firewall must be in Protection or Strict for Challenge/Block to actually run). If you see correct blocks without false positives, move to Math Challenge. After a week without issues, enable the Block.

Country Selection

The country selector includes approximately 80 countries with real-time search and multi-selection. You can type to filter or check/uncheck manually.

High-risk country shortcut

The "+ High risk" button automatically marks these five countries with reported high malicious activity:

🇨🇳 CN - China
🇷🇺 RU - Rusia / Russia
🇰🇵 KP - Corea del Norte / North Korea
🇮🇷 IR - Irán / Iran
🇮🇶 IQ - Irak / Iraq

💡 Note: This selection is a starting point, not a definitive recommendation. Review your own attack logs to decide which countries to add or remove.

⚠️ data-ssc-help: geo_blocking.countries — Contextual help key for the country selector.

Application Contexts

Geo Blocking can be applied to different parts of the site. Choosing the right context is key to avoiding false blocks in public areas.

🔒 wp-admin Recommended

Applies geo-blocking only to the admin panel. Front-end visitors are not affected. Ideal for protecting admin access without impacting the public experience.

🔑 Login / Registration Recommended

Protects the login, registration, and password recovery pages. Stops account creation and brute-force attacks from unwanted countries.

📮 POST Requests

Applies the filter only to POST requests (form submissions, comments, purchases). GET requests are not evaluated. Useful for stopping form spam without affecting navigation.

🌐 All traffic Risky

Applies geo-blocking to all requests, including front-end, APIs, REST, cron, etc. Not recommended except in very specific cases (intranet, sites with 100% local audience).

Exception paths

You can define paths that are excluded from geo-blocking. Useful for public APIs, webhooks, or pages that must be globally accessible. Supports wildcards (*).

# Ejemplos de rutas de excepción
/wp-json/*
/webhook/*
/checkout/
/api/public/*

💡 Recommendation: Enable wp-admin + Login at minimum. Add POST requests if you receive automated spam from certain regions. Avoid "All traffic" unless you have a very specific need.

⚠️ Caution with wp-admin and Login: if you enable geo-blocking on "wp-admin access" or "Login and registration" and your own IP is classified as being in a blocked country, you will be locked out of the panel or login. Add your IP to the Allowlist (Firewall → IP Lists) before enabling the block. If you have already locked yourself out, use the Emergency Restore link to temporarily disable the firewall and regain access.

Logging & Monitoring

Each Geo Blocking event is recorded in the firewall log with the following information:

📋 Logged information

Visitor IP

Detected country

Context (wp-admin, login, POST, all)

Requested URL

Action taken (Monitor, Challenge, Block)

📊 How to use the logs

Enable Monitor and wait 48 hours
Review which countries appear most in the logs
Adjust your country selection if you see legitimate activity being blocked
Move to Challenge when satisfied

📌 Geo Blocking logs are stored alongside other events in the firewall's Traffic Log. Filter the PROTECCIÓN (Protection) column by "Geo-Blocking" to see only this protection.

Limitations

Geo Blocking is a powerful tool, but it has important limitations you should know before implementing it.

🌍 IP-based geolocation

Geolocation is based on GeoIP databases that map IP addresses to countries. It is not 100% accurate. An IP may appear in a neighboring country, change ownership, or be misclassified. Typical accuracy is 95-99% for countries, but may be lower for mobile IPs or multinational companies.

🔓 VPN / Proxy Evasion

Any visitor using a VPN, proxy, or the Tor network can spoof their country of origin. Geo Blocking does not automatically detect or block VPNs. An attacker in a blocked country can choose a VPN server in an allowed country and evade the restriction. This is the most important limitation of geo-blocking.

📡 GeoIP database

The plugin uses a local GeoIP database that is updated periodically. If the database is outdated, some countries may be misclassified or new IPs may be missing. Automatic updates occur once a month, but depend on the server's connectivity to seensecure.com.

📱 Shared IPs / CDN

Visitors behind a CDN (Cloudflare, Akamai) or with shared IPs (mobile carriers, NAT) may show the CDN or gateway country, not their real location. If you use Cloudflare, the plugin detects the CF-IPCountry header for better accuracy.

📌 Remember: Geo Blocking is one more defense layer, not a standalone solution. Combine it with Attack Protection, Rate Limiting, Bot Protection, and the IP Blacklist for complete protection. No single layer is enough by itself.