Geo-Block Checker and Generator
Test whether a website blocks your country or blocks search crawlers, then generate geo-blocking rules for Cloudflare, Vercel, Next.js, WordPress, Shopify, Apache, nginx and more. Every rule exempts verified search crawlers.
- 100% free
- No sign-up
- Ethical defaults
- Search crawlers always exempt
Checker
Geo-block checker: is a website blocking your country?
Enter a URL. Our server requests it twice, once as a normal browser and once as Googlebot, and shows the status code, redirect chain and CDN for each. Use it to confirm a site is blocking a region, or to confirm your own geo-block still lets search crawlers through.
What this means
Full details: status, redirect chain and server fingerprint
Limits: 30 checks per day per visitor, 5 redirects followed, first 200 KB of each page read. Our server sits in one region, so a block here does not prove a site blocks every country. For other countries use a VPN or a multi-location service such as check-host.net. To see what Google sees, use URL Inspection in Search Console.
Before you block anyone, read this first
Blocking traffic by country is sometimes legitimate (e.g. you only ship to the UK, you only operate in specific markets, or you've measured high fraud rates from a region). But it can also be discriminatory if used carelessly, and it can have legal implications depending on your jurisdiction.
Our recommendation: start with bot, VPN and datacenter blocking. This removes 80% of low-quality traffic without restricting any real human visitor. Only add country blocking if you have a documented business reason. Prefer allow-listing your target markets over blocking other countries.
This tool generates code. You are responsible for how you use it.
Step 1: Pick a strategy
Choose your starting point
Pick one. You can refine the details below. Picking a strategy is a starting point, not a commitment.
Step 2: Pick your mode
Allow-list or block-list?
Allow-listing is usually safer and easier to maintain. Use block-list mode only when you need to restrict a small number of specific regions.
Block bots, scrapers and anonymisers
RecommendedThe ethical, precise way to remove low-quality traffic. Each category targets automated traffic (bots, scrapers, datacenter IPs, anonymisers) with virtually zero impact on real human visitors.
Country restrictions
Use sparinglyTick the countries where you want to allow access. Everyone else will be blocked.
Quick allow-list
No countries match your search.
Block action
What happens when a visitor matches your rules.
A site path (e.g. /region-not-served) or a full https:// URL.
Anything else falls back to /region-not-served. The destination is
excluded from the rule so the redirect cannot loop.
Pick your platform
Same configuration, generated for whichever stack you run. Cloudflare is recommended: it works with any underlying platform and has the richest bot signals.
The basics
What is geo-blocking?
What it is
Geo-blocking is the practice of restricting website access based on the visitor's location, IP address, or network behaviour. It happens at the network or application layer: the visitor either never reaches your server, or reaches it but is rejected. Major businesses use it for licensing compliance, fraud prevention, regulatory requirements, and market focus.
Bots vs countries
Most "bad traffic" attributed to specific countries is actually bot traffic, scraper traffic, or VPN-routed traffic from elsewhere. Blocking by country is a blunt instrument that affects real humans. Blocking bots and datacenter IPs is precise: it affects only automated traffic. Start with bot blocking. Add country blocking only if you have measured a specific business need.
What about SEO indexing?
You cannot directly tell Google "don't index my site in Pakistan". Google's index is global. What you can do: use hreflang tags to declare which countries each page targets, set geographic targeting in Google Search Console, use a country-specific TLD (.co.uk, .de, .fr) for strong country signals, and build country-specific backlinks from your target markets. These are separate from blocking traffic.
Decision guide
Should I block entire countries?
An honest walkthrough of when country blocking is reasonable, when it isn't, and what to try first.
When country blocking IS reasonable
- You operate a physical service in a specific region only
- You only ship to specific countries
- You're legally required to restrict by region (licensing, sanctions)
- You have documented, measurable fraud rates above ~5% from a region
- Your terms of service explicitly require it
When country blocking is NOT reasonable
- You "just have a feeling" certain regions are problematic
- You haven't tried bot / VPN filtering first
- You're blocking based on assumptions about people, not measured fraud
- Your business operates globally but you find the traffic "annoying"
Better alternatives to try first
- Bot, datacenter and VPN blocking (this tool, top option)
- Address verification and 3D Secure at checkout
- Stripe Radar or similar fraud-scoring rules
- CAPTCHA on contact and signup forms
- Honeypot fields on forms
- Rate limiting per IP
Heads up
Legal considerations
- GDPR: EU residents have a right to access information you publish. Blocking EU traffic outright may have compliance implications if you already process EU personal data.
- ADA / accessibility: US accessibility law applies to US-targeted businesses; a wholesale US block likely doesn't trigger ADA but consult a qualified solicitor before deploying.
- Discrimination laws: Some jurisdictions classify nationality as a protected characteristic. Country blocking for a non-business reason could expose you to liability.
- Sanctions compliance: Some countries (Cuba, Iran, North Korea, Syria) you may actually be required to block under US, UK or EU sanctions.
This is general information, not legal advice. Consult a qualified solicitor before deploying country-level restrictions on a commercial site, especially if you process personal data or operate across jurisdictions.
Step 3: Deploy it
Platform deployment guides
Step-by-step for every supported platform, including exactly how search crawlers are exempted on each one. Pick yours, follow the steps, then verify below.
Why Cloudflare first. Rules run at the edge before traffic reaches your origin, so there is no load on your hosting and they work in front of any platform (WordPress, Shopify, Wix, Squarespace, anything). The free plan includes five WAF custom rules, which is enough for this tool's output. Country, ASN, user agent and the verified-bot flag are all available on the free plan.
Simpler option: IP Access Rules
If all you want is to block or allow a handful of whole countries with no bot logic, you do not need an expression at all. Security → WAF → Tools → IP Access Rules lets you pick a country and an action (Block, Managed Challenge, Allow) from a dropdown. Country-level IP Access Rules are available on every plan. Use the generated expression when you need bots, ASNs, path conditions or a redirect.
Step-by-step
- Create a Cloudflare account at cloudflare.com and add your domain.
- Update your DNS to use the Cloudflare nameservers shown during setup, and make sure the record for your site is proxied (orange cloud). Unproxied traffic never passes through the rule.
- For a Hard block or Browse OK, no checkout: dashboard → Security → WAF → Custom rules → Create rule.
- For a Redirect: dashboard → Rules → Redirect Rules → Create rule. A WAF custom rule cannot redirect, so the output tells you to use a Redirect Rule instead.
- Give the rule a name, then click Edit expression to switch to the expression editor.
- Paste only the expression (the last line of the output). Lines starting with # are notes and the editor rejects them.
- Hard block: set the action to Block (or Managed Challenge for a softer check). Browse OK, no checkout: the expression already limits itself to /checkout, /cart and /basket, so set Block. Redirect: choose a static URL and status 302.
- Click Deploy.
Test it
- Use the checker at the top of this page, or
curl -I -A "Googlebot" https://yourdomain.com, to confirm a crawler user agent still gets a 200. - Use a VPN to switch your apparent country, then visit your site. You should see the 403, your redirect page, or the challenge, depending on the action.
- Dashboard → Security → Events shows every rule hit in real time.
Use a Worker when you need more control than a WAF rule gives you: custom responses, redirects with a loop guard, soft-blocks that leave browsing open, or logic based on path.
- Dashboard → Workers & Pages → Create application → Create Worker.
- Give it a name (for example geo-block).
- Paste the generated Worker script from the output panel above and click Save and deploy.
- Your worker → Settings → Triggers → Add route. Use a pattern like
yourdomain.com/*on your zone. - Deploy, then test with the checker at the top of this page.
For Next.js sites on Vercel this is the simplest option: one file in your repo, no extra packages. The country comes from the x-vercel-ip-country header that Vercel adds to every request on every plan, including Hobby.
- Create
middleware.tsin your project root (orsrc/middleware.ts). On Next.js 16 the file isproxy.tsand the export is namedproxy; the body is the same. - Paste the generated code from the output panel above.
- Commit and push. Vercel deploys automatically.
- Test with the checker at the top of this page and with a VPN.
Next.js middleware for any host: Vercel, Cloudflare, AWS CloudFront, Netlify or self-hosted Node. It reads whichever country header your platform sets. It never calls an external IP-lookup service: that would add latency to every request and send your visitors' IPs to a third party.
- Create
middleware.tsin your project root. On Next.js 16 the file isproxy.tsand the export is namedproxy; the body is the same. - Paste the generated code from the output panel above.
- Self-hosting behind nginx or Apache? Install the GeoIP module (see those tabs) and pass the country as a header, for example in nginx:
proxy_set_header X-Country-Code $geoip2_country_code;. - Deploy. The middleware runs on every matched route.
For Astro projects running in SSR mode. Works behind any platform that sets a country header: Vercel (x-vercel-ip-country), Cloudflare (cf-ipcountry) or your own proxy (x-country-code).
- Make sure your Astro project uses an SSR adapter (Vercel, Netlify, Node or Cloudflare) in
astro.config.mjs. - Create
src/middleware.tsand paste the generated code. - Commit and deploy.
WordPress has no native GeoIP support, so the snippet uses the free GeoIP Detection plugin to read the visitor's country, then enforces the rule on the template_redirect hook. Admin, login and cron are always skipped, so you can still sign in from abroad.
Step 1: Install the plugin
- WP Admin → Plugins → Add New.
- Search for GeoIP Detection by Yellow Tree. Install and activate.
- WP Admin → Settings → GeoIP Detection.
- Choose a data source (the free MaxMind GeoLite2 database needs a free MaxMind account) and save.
Step 2: Add the snippet
- Back up your site first. An error in functions.php can take the whole site offline.
- Safest route: install the free Code Snippets plugin and paste the code as a new PHP snippet. It can be switched off from the admin if anything goes wrong.
- Or: WP Admin → Appearance → Theme File Editor → functions.php, paste at the very bottom, Update File.
- Test with the checker at the top of this page and with a VPN.
If your only goal is to not sell to certain countries (rather than block them from the site), WooCommerce's built-in settings cover it with no code.
- WP Admin → WooCommerce → Settings → General.
- Selling location(s) → choose Sell to specific countries and pick your markets, or Sell to all countries, except for... to exclude a few.
- WooCommerce → Settings → Shipping → Shipping zones. Only add zones for the countries you ship to. Customers from unlisted countries cannot complete checkout.
- (Optional) Pair with the WordPress tab if you also want to stop visitors reaching the site.
Shopify's real geo-control is Markets. Disable a market and shoppers in that country cannot check out. The Liquid snippet adds a storefront message or redirect on top. It uses the shopper's selected market (localization.country), not their IP location, and it works in the browser, so it is not a security control.
Step 1: Configure Markets
- Shopify Admin → Settings → Markets.
- Remove or deactivate any market (country group) you do not want to serve, and keep only the countries you sell to in the markets that remain.
- Save.
Step 2: Add the Liquid snippet (optional)
- Shopify Admin → Online Store → Themes → Edit code on your live theme.
- Open
layout/theme.liquidand paste the snippet immediately after the opening<body>tag. - Save and preview the store with a different country selected.
For sites on Apache (most shared hosting). The snippet uses mod_maxminddb (current) and includes a fallback block for the legacy mod_geoip. The whole thing is one <RequireAll> block: two sibling <RequireAll> blocks would be OR-ed together and cancel the country rule, which is a common mistake.
Step 1: Verify GeoIP is available
- Create a temporary
info.phpin your site root containing<?php phpinfo(); ?>. - Open it and search the page for MM_COUNTRY_CODE (mod_maxminddb) or GEOIP_COUNTRY_CODE (mod_geoip). If neither appears, ask your host to enable the module. The generated rules fail open without it: nobody is blocked.
- Delete info.php after testing. Leaving it exposed is a security risk.
- Ask your host where the GeoLite2 databases live and adjust the
MaxMindDBFilepaths if they differ from/usr/share/GeoIP/.
Step 2: Add the rules
- Connect via SFTP or the cPanel File Manager and back up the existing
.htaccess. - Edit
.htaccessin your site root (create it if it does not exist) and paste the generated rules. - Save, then test with the checker at the top of this page. A typo in .htaccess takes the whole site offline; restore the backup if that happens.
For self-hosted Nginx servers (Linode, DigitalOcean, AWS EC2 and similar). Requires ngx_http_geoip2_module and the MaxMind GeoLite2-Country database (plus GeoLite2-ASN if you selected an ASN category). Everything is expressed with map blocks, so the only if is a single return.
- SSH into your server and install the module:
apt-get install libnginx-mod-http-geoip2(Debian / Ubuntu). - Download the free GeoLite2 databases from MaxMind (free account required) and place them at
/etc/nginx/GeoLite2-Country.mmdb(andGeoLite2-ASN.mmdbif needed). - Paste the HTTP-context blocks (geoip2 and all map blocks) inside
http { }, then theifinside your site'sserver { }block. - Test the config with
sudo nginx -t, then reload:sudo systemctl reload nginx. - Test with the checker at the top of this page and with a VPN.
Step 4: Verify it
How to test your geo-block
Do all four before you call it done. The first two take a minute; the last one is the only test that uses Google's real crawler.
-
Use the checker at the top of this page
Enter your URL. You get the status code for a browser request and for a Googlebot user-agent request from our server. If the browser request is blocked and the Googlebot one is not, your crawler exemption works. If both are blocked, our server's region is outside your allow-list, which is expected; move on to step 4 to confirm Google itself can still reach you.
-
Send a Googlebot user agent from your own machine
A 200 confirms the user-agent exemption. A 403 means the rule is blocking the crawler user agent, which is the one thing you must fix before leaving the rule live. Because your own IP is in your allow-list, this does not test the country rule itself; that is what the VPN step is for.
curl -I -A "Googlebot" https://example.com/ -
Switch country with a VPN
Connect through a country you block, open the site in a normal browser, and confirm you see the 403, your redirect page, or the soft-block on /checkout. Then visit the redirect page directly to confirm it does not loop. On Cloudflare, Security → Events lists every rule hit as it happens.
-
URL Inspection in Google Search Console
Open URL Inspection, enter a page, and click Test live URL. This fetches with real Googlebot from Google's own IP addresses, so it is the only test that proves Google can reach you after the rule is live. If it reports "Blocked" or a 403, loosen the rule before anything else.
Frequently asked questions
The questions we hear most from clients setting up geo-blocking for the first time.
How do I check if a site is geo-blocked?
Use the checker at the top of this page. Enter the URL and our server requests it twice, once with a normal browser user agent and once identifying as Googlebot, then reports the status code, any redirect chain, whether the response looks like a block page, and which CDN served it. Our server sits in one region, so a 403 tells you the site blocks that region or blocks automated requests, not that it blocks every country. To test from other countries use a VPN, or a multi-location service such as check-host.net. To see what Google itself sees, use the URL Inspection tool in Search Console.
Why does the checker say blocked when I can open the site?
Three common reasons. (1) The site blocks the region our server is in but not yours. (2) The site blocks requests that do not look like a real browser: our check sends a plain HTTP request without running JavaScript, so a Cloudflare challenge, a bot-protection page or a 403 for the Googlebot user agent shows as blocked even though a browser passes. (3) The block-page detection matched words such as "access denied" on an ordinary page. Compare the two user agents: if the browser request gets 200 and the Googlebot request gets 403, the site is blocking crawlers by user agent, which is worth fixing if it is your site.
Will geo-blocking hurt my SEO?
Not if search crawlers can still reach the site. Every template this tool generates exempts verified search crawlers. On Cloudflare the expression is wrapped in "not cf.client.bot" and the Worker checks cf.verifiedBotCategory, both available on every plan. On Vercel, Next.js, Astro, WordPress, Apache and nginx the exemption is by user agent (Googlebot, Bingbot, DuckDuckBot, Slurp, YandexBot, Applebot), which can be spoofed, so treat it as a convenience and verify crawlers by reverse DNS if you need certainty. Googlebot mostly crawls from US IP addresses, so if the US is not in your allow-list the exemption is what keeps you indexed; check Search Console after deploying. Country blocking stops real visitors in those countries from reaching you, which also means fewer links and signals from those markets.
What is the difference between blocking countries and blocking bots?
Country blocking restricts real human visitors based on their IP location: a blunt instrument that affects a wide population. Bot blocking restricts automated traffic (scripted clients, hosting networks, Tor, abusive networks): a precise instrument that affects almost no real visitors. Bot blocking is the recommended starting point for almost any site. Country blocking should only be used when you have a documented business reason, such as only shipping to certain countries, only operating in certain markets, or measured fraud from a specific region.
Will the Cloudflare free plan handle this?
Yes for the country, ASN, user-agent and Tor conditions, and for the verified-bot exemption (cf.client.bot). The free plan includes five WAF custom rules and unlimited IP Access Rules. The one exception is the "Cloudflare bot score" category: cf.bot_management.score and cf.bot_management.verified_bot only exist on an Enterprise plan with Bot Management, so an expression containing them will not save on Free, Pro or Business. Leave that category unticked unless you are on Enterprise.
Can I block Google or Bing accidentally?
The generated code exempts search crawlers on every platform, so only a manual edit could block them. The exemption is real on Cloudflare (verified-bot flag) and user-agent-based elsewhere. Two ways to confirm after deploying: run the checker at the top of this page, which sends a Googlebot user agent and shows you the status code, and use URL Inspection in Google Search Console, which fetches with real Googlebot from Google's own IP addresses.
What about VPN users who are legitimate customers?
This is a real trade-off. No platform offers a reliable VPN flag on a free tier, so the "VPN and proxy networks" category is an approximation that blocks a few hosting networks carrying many commercial VPN exits. It will miss some VPNs and catch some non-VPN traffic. Roughly 10 to 20% of UK and EU adults use a VPN at least occasionally. If you need the category at all, pair it with the "Browse OK, no checkout" action so VPN users can still read your content and only purchase paths are refused, or use Cloudflare's Managed Challenge instead of a hard block.
How accurate is IP geolocation?
Roughly 95% accurate at country level and much less at city level. Mobile carriers, corporate networks and VPNs reduce accuracy further. Never rely on IP geolocation for anything mission-critical: for shipping or legal compliance use the customer-confirmed billing address at checkout. IP-based blocking is fine for fraud reduction and market focus because a false positive is recoverable (the visitor can contact you), but treat it as one signal among several.
Can I block specific cities or regions within a country?
Yes on nginx with the GeoLite2-City database ($geoip2_city_name), and on Cloudflare with ip.src.city or ip.src.region (available on Business and Enterprise plans). This tool generates country-level rules because that is what almost every business case needs; extend the rules by hand for city or region logic.
Does this work for Squarespace, Wix, or other no-code platforms?
Not directly, because those platforms do not let you run middleware or edit server configuration. The workaround is to put Cloudflare in front of the site (point your DNS through Cloudflare while your hosting stays where it is) and apply the rule there. The Cloudflare WAF rule tab produces an expression that works in front of any platform, including Squarespace, Wix, Webflow and GoDaddy.
How do I test my geo-block is working?
Four ways, from quickest to most authoritative. (1) The checker at the top of this page: it fetches your URL from our server with a browser user agent and with a Googlebot user agent and shows the status of each. (2) A one-line test from your own machine: curl -I -A "Googlebot" https://yourdomain.com should return 200 if the crawler exemption works. (3) A VPN to switch your apparent country, then visit the site in a browser; you should see the 403, redirect or soft-block you chose. (4) URL Inspection in Google Search Console, which fetches with real Googlebot from Google's own IP addresses and is the final word on whether Google can reach the page. On Cloudflare, Security → Events also lists every rule hit.
Should I block by country or by language?
Different things. Country is IP location; language is the browser's Accept-Language header. For fraud prevention, country is the relevant signal. For showing the right localised content, language (and hreflang) is the relevant signal, and you should never block for it. This tool handles country only.
Not sure what's draining your conversion rate?
Send us your website address on WhatsApp and we will tell you what is worth fixing first, free and with no obligation. Or pick the service that fits.
-
Find what to fix
£295
SEO Audit: a full review of your site, a prioritised fix list and a 30-minute call to walk you through it.
See SEO services -
Build you a new website
From £900
Fast, mobile-friendly websites with SEO set up from launch. Fixed prices from £900, no VAT to add.
See web design packages -
Grow your traffic every month
From £250 a month
on the 6-month plan, £1,500 paid upfront
Monthly SEO: technical, local and content work with plain-English reporting. No long contracts: SEO plans run for 1, 3 or 6 months, paid upfront, and nothing renews automatically.
See Monthly SEO
Or call 020 8050 4108.
Other free SEO tools
Robots.txt Generator
Block AI crawlers, scrapers and search bots at the protocol layer. 18 AI bot controls included.
Open tool →SEO Audit
Full-site SEO audit in 30 seconds: Lighthouse scores, security grade, on-page checks.
Open tool →Schema Validator
Paste any URL, see every schema block, plain-English fixes for what's broken.
Open tool →