Problem Description
- You wish to block an entire country or multiple countries
- You see traffic from countries that are not in your market, so why waste resources on them?
Note: while this article is primarily about blocking countries when using your own VPS, the principles and some of the solutions apply to any level of hosting.
Problem Resolution
There's a few things to consider before you proceed with blocking an entire country or multiple countries:
- Frequently plugins and licenses have activation and update servers located in other countries. Blocking access to these countries will block your ability to receive updates to your software.
- If you have Plesk Control Panel on your server, it requires access to various IPs in Europe to validate the license; if they can't do that, you will eventually lose access to Plesk. The same is true for the licensing for the Imunify360 security layer.
- Frequently website and server status checkers will use global IP networks to ensure your site remains up from everywhere in the world. If you block certain countries, it might make your uptime checker think the site is down or frequently up and down.
- If you are hosting email services on your VPS, you are likely to experience odd mail deliverability issues for both those attempting to send you messages and messages you send. This is true even for big mail providers like Google or Microsoft as their sending servers and/or DNS lookup functions exist in multiple countries. If one such server attempts to send from a country that is blocked (and you have no control over this) the messages will simply silently fail to be delivered.
If you're sure the above items will not apply to you, or you can configure the software to bypass your firewall, then we've got two recommended ways to block entire countries (note these apply to your own VPS only, not shared hosting):
- If you have an Imunify360 license, you can simply go to the Imunify UI in Plesk, select Blacklist and add countries there.
- ConfigServer Firewall (CSF) has a country blocking tool built in: https://download.configserver.com/csf/readme.txt
There are two remaining options that we don't directly recommend but you're welcome to try at your own risk (these work on a per-domain level):
- Enabling CloudFlare on your domain allows you to enable country blocks within the CloudFlare firewall. Be sure to read the caveats with using CloudFlare before choosing this option.
- Some security plugins for WordPress will allow you to block countries. If you opt for this option, be very careful that they don't handle these blocks by .htaccess file. Entire country blocks handled via .htaccess is super inefficient because it means adding thousands of IP range entries to the .htaccess file, making it fairly large in size and therefore inefficient for the web server to load and scan on every request. What's the point of blocking numerous countries if your site becomes slower for everyone that accesses it?
