FAIR

Federated and Independent Repositories

OWS IP & Country Block

Plugin Banner

OWS IP & Country Block

by Abu Nawim

Download
Description

OWS IP & Country Block is a powerful WordPress plugin that allows you to block users based on their IP addresses and countries. This plugin helps enhance your website security by preventing access from unwanted sources.

Key Features:

  • IP Address Blocking: Block specific IP addresses or IP ranges using CIDR notation
  • Country-based Blocking: Block entire countries from accessing your website
  • IP Whitelist: Create a whitelist of IP addresses that should never be blocked
  • Customizable Block Message: Set a custom message to display to blocked users
  • Access Logging: Keep track of blocked access attempts with detailed logs
  • Easy Administration: Simple and intuitive admin interface
  • Performance Optimized: Lightweight and fast with minimal impact on site performance

Use Cases:

  • Prevent spam and malicious attacks from specific countries
  • Block competitors from accessing your content
  • Comply with legal requirements for geo-blocking
  • Enhance security by blocking known malicious IP ranges
  • Control access during maintenance or testing

Security Features:

  • All user inputs are properly sanitized and validated
  • Uses WordPress nonces for form security
  • Follows WordPress coding standards and best practices
  • Compatible with caching plugins and CDNs

External Services

This plugin connects to ip-api.com to determine the country of a visitor’s IP address. This lookup only occurs when country blocking is enabled and the visitor’s country is not already cached.

  • Data sent: The visitor’s IP address.
  • When: On each frontend page load when country blocking is active and no cached result exists for that IP.
  • Service provider: ip-api.com
  • Terms of Service: https://ip-api.com/docs/legal
  • Privacy Policy: https://ip-api.com/docs/legal

Privacy Policy

This plugin stores IP addresses and country information for blocked access attempts in your WordPress database. This data is used solely for security purposes and is not shared with third parties. The plugin may make requests to free GeoIP services to determine visitor countries.

Support

For support, feature requests, or bug reports, please visit the plugin’s GitHub repository or contact the developer.

Credits

This plugin uses the IP-API service for country detection. Special thanks to the WordPress community for their coding standards and best practices.

  1. Upload the plugin files to the /wp-content/plugins/ip-and-country-block directory, or install the plugin through the WordPress plugins screen directly.
  2. Activate the plugin through the ‘Plugins’ screen in WordPress
  3. Use the Settings->IP & Country Block screen to configure the plugin
  4. Add IP addresses or select countries you want to block
  5. Enable the blocking features and save your settings
How do I block an entire country?

Go to Settings -> IP & Country Block, enable “Country Blocking”, select the countries you want to block from the dropdown list, and save your settings.

Can I block IP ranges?

Yes, you can block IP ranges using CIDR notation. For example, to block the range 192.168.1.0 to 192.168.1.255, enter “192.168.1.0/24”.

Will this plugin slow down my website?

No, the plugin is designed to be lightweight and efficient. It only performs checks on the frontend and uses caching to minimize database queries for country lookups.

Can I whitelist certain IP addresses?

Yes, you can add IP addresses to the whitelist that will never be blocked, even if they match other blocking rules.

Does this work with CDNs like Cloudflare?

Yes. If your site is behind Cloudflare or another reverse proxy/CDN, go to the plugin settings and choose the matching option under “Trusted Proxy Header” so the plugin reads the visitor’s real IP from the header your proxy sets. This is not enabled by default, because trusting these headers on a site that is not actually behind that proxy would let visitors fake their IP address and bypass blocking.

Why isn’t IP blocking working behind my CDN?

By default the plugin only trusts your web server’s own connection info (REMOTE_ADDR), which is safe but on CDN/proxied sites is the proxy’s IP, not the visitor’s. Go to Settings -> IP & Country Block and set “Trusted Proxy Header” to match your CDN/proxy (for example, Cloudflare) so the real visitor IP is used.

Can I see who has been blocked?

The plugin logs all blocked access attempts in the database, including IP address, country, timestamp, and reason for blocking.

Will this block search engines?

The plugin only blocks frontend access. Admin users and search engine bots that access your site properly should not be affected. However, be careful when blocking countries where major search engines operate.

1.1.0

  • Security: IP detection no longer trusts client-supplied headers (X-Forwarded-For, Client-IP, etc.) by default, which previously allowed spoofing to bypass blocks. A new “Trusted Proxy Header” setting lets you opt in to a specific header only if your site genuinely sits behind that proxy/CDN.
  • Fix: CIDR matching now supports IPv6 ranges in addition to IPv4.
  • Fix: uninstall routine now correctly drops the plugin’s log table (previous query used an invalid placeholder for the table name).

1.0.0

  • Initial release
  • IP address blocking with CIDR support
  • Country-based blocking
  • IP whitelist functionality
  • Access logging
  • Customizable block messages
  • Admin interface
Back to top