Geo blocking — refusing every address a geolocation database maps to a given nation — is the country-level filter most site owners meet first. Blocking a country this way is the bluntest instrument in the whole subject, the one people reach for first, and the one that most often solves a smaller problem than the one it creates. Anyone with a free VPN walks around it in under a minute.
That does not make it useless. It makes it a compliance control rather than a security control — genuinely correct for licensing and legal restrictions, genuinely weak against anyone who wants in. Most guides sell it as security. That framing is why so many sites end up blocking customers instead of attackers when they block a country.
So this guide answers how to block a country from your website properly: the geo-blocking inversion that halves the work, where to apply the rule, how accurate country detection really is, what a VPN does to it, whether your search rankings survive, and the European regulation that can make a country block illegal rather than merely ineffective.
The pattern I see is always the same. A small business gets tired of spam signups, blocks four countries, and the noise drops. Six weeks later somebody notices a customer complaint from a sales rep who was travelling, and nobody connects the two. The attacker who caused the original problem moved to a residential exit in an allowed country the same afternoon. The block is still running, still catching nobody, and still costing something.
My honest position is that geo-blocking earns its place in exactly two situations. You have a legal obligation to restrict a territory, or you serve one country and everything else is pure overhead. Outside those, a country block is a loud rule that mostly inconveniences people who were never the problem, and there is nearly always a narrower instrument available.
Quick Answer: Blocking a Country by IP
Apply the rule at your CDN or WAF using two-letter country codes, and prefer allowing the countries you serve over denying the ones you do not. Never build it from a raw address list — blocking a single large country that way runs to six figures of lines. Check what a given address reports with an address and location lookup before you act on it.
What Does Blocking a Country Actually Do?
Geo-blocking refuses traffic based on a guess. Your firewall, CDN or application takes the visitor's address, looks it up in a commercial geolocation database, receives a two-letter country code, and compares that code against your rule. Nothing about the address itself contains a country. The mapping is built from registry records, routing data and network operator feeds, and it is an inference rather than a fact.
The country codes follow the ISO 3166-1 alpha-2 standard, so US, DE and JP mean what you expect. Some platforms add non-standard codes on top — Cloudflare uses T1 for Tor exit nodes and XX for addresses it cannot place at all.
| This Is | This Is Not |
|---|---|
| Geo-blocking — refusing by country code from an address | Geofencing — which uses device GPS, usually in a mobile app |
| A statistical inference from network data | Knowledge of where the person physically is |
| Country-level filtering | Address allowlisting, which targets specific hosts |
| A compliance and licensing control | A security control against motivated attackers |
Row one gets confused constantly, and row four is the confusion that costs money. Which leads to the decision most guides skip entirely.
Should You Block Countries, or Allow Only Yours?
Allow the countries you serve rather than blocking the ones you do not. If your customers are all in two nations, an allowlist of two entries replaces a denylist of well over two hundred, and it stays correct when a new address block is allocated somewhere you never considered. A geo-blocking denylist has to be maintained forever and is wrong the moment the world changes. The maths only runs one direction for a locally focused business.
Several platforms ship a one-click preset that names specific nations as the ones most attacks come from, and it is worth understanding what those presets do before you enable one. They apply the same country-code filter described here, with the same accuracy limits and the same VPN problem, chosen by a vendor rather than by you. Whether any particular country belongs on your list is a business judgement, not a security fact.
The exception is a genuinely international site. A hotel, a tourist attraction, a university or anything selling across borders needs the world reachable, and for those an allowlist is the wrong shape entirely. That is the honest split: local business, allowlist; international business, neither.
Check the law before the config
If you sell goods or services to customers in the European Union, EU Regulation 2018/302 prohibits unjustified geo-blocking based on a customer's nationality or place of residence — and it applies whether your business sits inside the EU or outside it. Blocking an EU country to reduce spam is not obviously a justification. This is a legal question before it is a technical one.
There is also a sharper instrument sitting right next to this one. Abuse concentrates in specific hosting networks rather than spreading evenly across a nation, which is why removing one operator by its network number usually beats removing a country: it takes out the servers and leaves that country's real residents reaching you normally.
Once the decision is made, where you enforce it changes how much it costs you.
Where Should You Apply a Country Block?
Apply a country block as far from your server as possible. A CDN or WAF resolves the country and refuses the request before it consumes your bandwidth or CPU, which is why it is the default recommendation everywhere. Server modules work but spend your own resources doing it, while application-level checks give the finest control and add latency to every request. DNS-based geo-routing is useful for redirecting people and useless as enforcement.
| Layer | How | Trade-off |
|---|---|---|
| CDN / WAF | Country field in a rule expression | Fastest and cheapest — start here |
| Web server | A GeoIP module reading a database | Works, costs CPU on every request |
| Application | Country lookup inside your own code | Per-endpoint control, adds latency |
| DNS geo-routing | Different answers by resolver location | Never use for enforcement — trivially bypassed |
| Raw address list | Every range for that country, by hand | Six figures of lines for one large country |
That last row deserves a number. Building a country block from raw ranges in a per-directory server file can run past 150,000 lines for a single large nation, on a file the server re-reads every request. If you genuinely need address-level rules, the arithmetic behind them is in our guide to turning ranges into workable prefixes — but for country work, do not go near it.
On the CDN side, note that vendors move things. Cloudflare retired its old Firewall Rules naming, so country blocking now lives under Security, then Security Rules, then Custom rules, and blocking by country through the older IP Access rules requires an Enterprise plan. The expression syntax is in our walkthrough of writing rules in the Cloudflare engine.
Placement settled, the harder question is whether the country code is even right.
How Accurate Is Country Detection?
Above 99% at country level for commercial databases on assigned IPv4 space, and considerably worse everywhere else. City-level targeting drops to roughly 80%. Accuracy falls further on mobile carrier ranges, on small or recently reallocated blocks, and across IPv6, where the databases are still catching up with new allocations. Every one of those error rates is inherited by your country block, and none of them announces itself.
Mobile is the failure people meet most. A subscriber on a carrier that operates across several countries can present as the carrier's registration country rather than wherever they actually are, so a perfectly ordinary customer arrives wearing the wrong flag. There is nothing wrong with your rule when that happens; the input was wrong before your rule ever saw it.
This is the same mechanism that makes people's own connections report the wrong place, which our explainer on why an address shows a city you have never visited works through from the visitor's side. Reading it is worthwhile precisely because it describes the data you are about to make decisions with.
Even a perfectly accurate lookup only tells you where the connection appears to come from, and appearances are cheap.
Does a VPN Defeat Country Blocking?
Yes, comprehensively, and in about a minute. Geo blocking is the easiest control on the internet to walk around, because the visitor simply picks an exit in a country you allow. Commodity VPN services run thousands of exit addresses and rotate them constantly. This is not a weakness in your configuration; it is the nature of attributing location to an address at all.
Residential proxy networks are the harder version. They route through real consumer connections, so the traffic looks organic to any geolocation database and carries a residential classification that no country rule will question. Anyone running a serious scraping or fraud operation already has this, which is precisely why country blocking works on casual noise and not on determined actors.
The mirror problem
The same mechanism that lets an attacker in keeps your own people out. Staff on a corporate VPN whose exit sits abroad, colleagues travelling, and customers on holiday all arrive from the wrong country. Build a support path for false positives before you deploy, because you will need it — and the people using it will be the ones you least wanted to block.
If bypass traffic is your actual concern rather than geography, the honest move is to detect it directly rather than guess at nationality. Our guide to how proxy detection is defeated in practice is worth reading from the other side of the fence, because it describes exactly what you are up against.
Bypass is one cost. There is a second one, and it arrives silently in your search traffic.
Will Blocking Countries Hurt Your Search Rankings?
It can, and the damage is quiet. Search crawlers and AI agents fetch from infrastructure spread across many countries, so a broad geo blocking rule can refuse the very requests that keep you indexed. Nothing warns you when it happens. The symptom surfaces weeks later as a slow decline in impressions, and by that point the change that caused it looks entirely unrelated.
Watch three signals after any country rule goes live. A spike in 403 responses in your crawl statistics, a drop in indexed pages, and any change in crawl frequency. All three are visible in search console tooling and none of them will alert you on their own.
The related trap is allowlisting crawlers by user agent, which anything can claim. If you intend to exempt search and AI crawlers from a geographic rule, exempt verified ones — the method is in our guide to confirming a crawler is genuinely who it says, and a user agent string alone is not evidence of anything.
Technical cost accounted for, one category of risk remains and it is not technical at all.
Is Geo-Blocking Legal?
Geo-blocking legality depends entirely on who you are blocking and why. Restricting a territory because a licence requires it is normal commercial practice. Refusing European customers because it reduces your spam is a different matter, and EU Regulation 2018/302 prohibits unjustified geo-blocking based on nationality or place of residence for anyone selling into the Union. The obligation follows the customer, not your company's address.
Enforcement is uneven rather than absent. A European Court of Auditors review found penalties for infringement ranging from €26 in some member states to €5 million in others, with criminal liability available in a few. The Commission ran a public consultation on the regulation's effectiveness between October 2025 and January 2026, so the framework is under active review rather than settled.
Tell People Why, With the Right Status Code
When a block genuinely is legal in origin, there is a status code for saying so. RFC 7725 defines 451 Unavailable For Legal Reasons, standardised in 2016 and named after Ray Bradbury's novel. It says the resource exists and could be served, but a legal demand prevents it — which a generic 403 cannot express.
| Code | Means | Use For |
|---|---|---|
| 403 Forbidden | We understood, and we refuse | Ordinary policy blocks |
| 451 Unavailable For Legal Reasons | It exists, but law prevents serving it | Licensing, court orders, jurisdiction |
| 404 Not Found | Nothing is here | Never — hiding a block this way misleads |
The specification also asks you to identify the blocking party in a Link header and explain the demand in the body. Beyond compliance, transparency is simply better service: a visitor who sees a clear reason can contact you, while a visitor who sees a bare refusal assumes your site is broken.
That covers the decision entirely. Deployment has one habit worth building.
How Do You Deploy and Reverse a Country Block Safely?
Start softer than a hard country block and keep the reversal one click away. A country rule is reversible in seconds and its damage is not, because the customer who could not reach you on Tuesday does not come back on Wednesday to check whether you fixed it. Challenge before you deny, watch what changes, and write down what you did so the next person can undo it.
Six Steps For A Country Rule
1 Confirm it is a country problem
Group a week of logs by country and by network operator. If the traffic concentrates in two or three hosting providers, the answer is an operator rule, not a national one.
2 Check the legal position first
If any blocked country is in the EU and you sell to customers there, stop and get advice. This ordering matters: the technical change is trivial to make and awkward to explain afterwards.
3 Challenge before you block
Set the action to a challenge rather than a denial for the first week. Real people pass it, most automation does not, and nobody is silently locked out while you watch the numbers.
4 Consider blocking actions, not access
Refusing form submissions and logins while still serving pages stops the spam without removing readers. It is the middle option almost nobody configures, and it fits most of the reasons people block countries.
5 Test from outside and read the crawl stats
Load the site through a connection in a blocked country and confirm the response is what you intended. Then check crawl statistics for a 403 spike, which is the earliest sign you caught something you needed.
6 Record the reason and a review date
Note which countries, why, who approved it, and when to revisit. Country rules outlive the incidents that caused them more reliably than any other kind, because nothing ever forces you to look at them again.
Step four is the one I would push hardest. Most people describing a country problem are describing a form problem, and blocking submissions solves it without touching anybody's ability to read the site.
That is the whole picture, legal exposure included. Here is what to keep.
The Short Version
Use geo-blocking only when you have a legal reason or serve one market exclusively, and in that second case allow your own countries rather than denying all the rest. Two allowed entries beat two hundred denied ones, stay correct as address space is reallocated, and need no ongoing maintenance from anybody. Apply the rule at your CDN, and never build it from a raw address list.
Treat the country code as an estimate. Detection is above 99% accurate nationally and much worse on mobile carriers, small reallocated blocks and IPv6, and any visitor with a VPN presents whichever country they choose. Geo blocking reduces casual noise and does nothing at all to a determined actor.
Check the legal position before the configuration if you sell into the European Union, use 451 rather than 403 when a block really is legal in origin, and watch your crawl statistics afterwards. When the traffic actually concentrates in a few networks rather than a nation, a narrower rule serves you better — the comparison of every blocking scope and layer covers how to choose.
Check Before You Block A Nation
See whether an address is really a VPN or proxy exit rather than the country it claims, and how risky it scores before you write a rule around it. Free, instant, no account.