For WordPress WordPress edition: for any WordPress site, WooCommerce optional. Also available for Vendure: Geo Block for Vendure

For WordPress

Geo-block for WordPress

Allow or block visitors by country or region on any WordPress site, with IP and crawler allowlists, a branded block page and business hours.

Free plugin on WordPress.org Download Pro: 14 days free, no card Pricing v0.1.1

Install on WordPress: install the free plugin from WordPress.org (Plugins → Add New), or upload the zip under Plugins → Add New → Upload Plugin.

Requires WordPress 6.5+ and PHP 8.1+. Works on any WordPress site; WooCommerce is optional and switches on the shop features.

Free plugin

What the free plugin does

HULO Geo-block decides, before WordPress runs its main query, whether a visitor may use your site. Allowed visitors are untouched; refused visitors see a branded block page or are redirected.

Works on any WordPress site. With WooCommerce it also refuses add-to-cart and checkout (classic checkout and the Checkout block) for blocked visitors, uses WooCommerce's MaxMind geolocation, and with HULO Payments it refuses payments from blocked visitors.

Rules

Region presets: Worldwide, United Kingdom only, European Union, North America and Oceania.
Extra allowed countries and always-blocked countries (for example "the EU except one country", or "worldwide except a few").
A live, plain-English summary of what the rules do, and a warning before you save rules that would block everyone.

Never locks you out

Administrators (and, with WooCommerce, shop managers) are never blocked.
wp-admin, the login page, cron, AJAX, the REST API, XML-RPC, payment-gateway callbacks (wc-api), robots.txt and sitemaps are never blocked.
IP allowlist with IPv4 and IPv6 addresses and CIDR ranges, plus a one-click "Add my IP".

SEO-safe

Well-known search and link-preview crawlers (Googlebot, Bingbot, DuckDuckBot, Applebot, Facebook, LinkedIn, Slack, WhatsApp and more) are let through by default, so a country restriction does not drop your store out of search results. Permissive, custom and off modes are available.
Crawlers may only browse. A User-Agent can be faked, so add-to-cart, checkout and payments are never exempt.
Optional reverse-DNS verification of Googlebot and Bingbot: a visitor claiming to be one is checked against googlebot.com / search.msn.com before it is let through.
Block pages send noindex; closures (business hours, maintenance) send HTTP 503 with Retry-After so search engines treat them as temporary.

Business hours and maintenance

A weekly opening window in any time zone, including overnight windows and daylight saving.
A one-off maintenance window with its own allowed IPs.

Geolocation without external calls

Cloudflare CF-IPCountry (and cf-region-code), Akamai and Fastly country headers, once you tell the plugin the site is behind that CDN. Any visitor can send these headers, so they are honoured only for requests arriving from a trusted proxy: Cloudflare's published ranges (one tick) or the addresses you list (or the HULO_TRUSTED_PROXIES constant).
Web-server GeoIP modules (GEOIP_COUNTRY_CODE, MM_COUNTRY_CODE).
With WooCommerce: its own geolocation, including its MaxMind database integration.
This plugin never calls a geolocation API. If no source is available yet, the settings page says so and visitors with an unknown country are allowed.
A full country list ships with the plugin; with WooCommerce its translated list is used.
Proxy-aware visitor IP: by default only the connecting address is used. Forwarding headers you tick are read only from trusted proxies, and for X-Forwarded-For the right-most address that is not one of your proxies is taken.

WooCommerce and HULO Payments (optional)

With WooCommerce active, add-to-cart, the classic checkout and the Checkout block (Store API) refuse blocked visitors on the server, whatever a page cache served.
With HULO Payments active, payments from blocked visitors are refused before they are charged.

Cache-safe

Only refused responses are changed, and they are sent with no-store and DONOTCACHEPAGE, so no page cache stores a block page.
Optional page-cache helper: if a full-page cache serves pages without running WordPress, a small script re-checks the visitor against an uncached endpoint.

Headless storefronts

GET /wp-json/hulo-geo-block/v1/check returns the current visitor's verdict (rate-limited, uncached). A server-side caller can pass the visitor's country signed with a secret.

Geo-block Pro

The optional Pro add-on adds 32 more region presets (EEA, Schengen, EFTA, GCC, ASEAN, LATAM, APAC, Commonwealth and more), rules for 249 states, provinces and regions in 11 countries, a soft block that lets visitors browse with a notice but not buy, an audit log with blocked-traffic stats and a dashboard widget, a rule simulator and a weekly e-mail report. Try it free for 14 days, no card: huloglobal.com/wordpress-plugins/geo-block.

Pro add-on

Geo-block Pro

Pro add-on for the free HULO Geo-block plugin. Works on any WordPress site; with WooCommerce the soft block also keeps products from being bought. Adds:

32 more region presets: Geographic Europe, EEA, EFTA, Schengen, British Isles, Nordic, Baltic, Benelux, DACH, Iberia, Balkans, Central and South America, Caribbean, LATAM, ANZ, GCC, MENA, ASEAN, APAC, East and South Asia, Africa, G7, G20, BRICS, OECD, NATO, Five Eyes, English-speaking and Commonwealth.
State, province and region rules for 249 subdivisions in 11 countries (UK nations, US states, Canadian provinces, Australian states, German Länder, Italian, French and Spanish regions, Indian states, Brazilian and Mexican states).
Soft block: refused visitors can browse with a notice instead of a wall. With WooCommerce nothing can be bought (classic checkout, Checkout block and add-to-cart); with HULO Payments their payments are refused. Also available outside business hours.
Audit log of refused visits (IPs hashed with a per-install salt by default, retention you choose), a Stats tab, a "Blocked · last 7 days" figure and a dashboard widget.
A simulator that runs your rules for any country, region, IP and user agent.
A weekly e-mail report and a set-up checklist.

Every install starts with a 14-day evaluation with everything on and no card. Subscribe from the plugin page; the licence installs itself. If the evaluation or licence ends, nothing is deleted: rules, settings and the log are kept, saved region presets stay in force, and the premium behaviour pauses until a licence is installed.

Pricing

Free, then Pro when you want it

Free plugin

£0

Free forever, GPL-licensed.

Pro, monthly or annual

£4.95/month

The first 14 days are free with no card. Subscribe from the plugin page when you're ready; the first charge is taken when the 14 days end. Annual billing gets two months free. Cancel any time.

Pro, lifetime

£99

One payment for one store, including updates.

Buy lifetime

Prices follow the currency picker at the top of the page; the checkout bills in GBP, USD, EUR, AUD and CAD. One licence covers one WordPress site.

Install

Installation

Install HULO Geo-block from Plugins → Add New, or upload the zip, and activate it.
Go to HULO → Geo-block. If the page says no country source was found, put the site behind a CDN that sends the visitor's country (for example Cloudflare), enable a GeoIP module in your web server, or, with WooCommerce, add a MaxMind licence key in WooCommerce → Settings → Integration.
On the Rules tab pick the regions or countries you serve, tick "Apply the country rules to visitors" and save.

For Pro, upload hulo-geo-block-pro-0.1.1.zip the same way (Plugins → Add New → Upload Plugin) with the free plugin active. The 14 days start automatically, and Pro updates itself from WordPress's Plugins screen.

FAQ

Frequently asked questions

Can I lock myself out?

No. Administrators (and shop managers when WooCommerce is active) are never blocked, wp-admin and the login page are never blocked, and the plugin will not switch on rules that would allow no one.

Do I need WooCommerce?

No. Geo-block works on any WordPress site. WooCommerce adds checkout protection and its MaxMind geolocation.

What happens when a visitor's country is unknown?

They are allowed. Set up a country source (CDN headers, a web-server GeoIP module, or WooCommerce's MaxMind integration) so countries are known.

Does it work with page caching?

Yes. Block pages are never cached. If your cache serves HTML without running WordPress, turn on the page-cache helper on the Settings tab. With WooCommerce, checkout always re-checks on the server.

Will Google still index my store?

Yes, by default search and link-preview crawlers are let through.

Can a visitor fake their country or pretend to be Googlebot?

Country headers are only believed when the request comes from a proxy you trust, so a visitor cannot send their own. A crawler User-Agent only lets a visitor browse, never buy or pay, and with reverse-DNS verification on, a fake Googlebot or Bingbot is treated like any other visitor.

Does the plugin contact any external service?

No. See "External services" below.

External services

Free plugin

This plugin does not connect to any external service. Country lookups use request headers set by your CDN or web server, or, when WooCommerce is active, WooCommerce's own geolocation.

If you turn on "Verify Googlebot and Bingbot by reverse DNS" (off by default), a visitor whose User-Agent claims to be Googlebot or Bingbot has their IP address looked up in DNS (a reverse lookup, then a forward lookup of the returned host name) through your server's own DNS resolver. The answer is cached for a day. Only the visitor's IP address is involved; no data is sent to Google, Microsoft or HULO. If you enable WooCommerce's MaxMind integration, WooCommerce itself downloads the GeoLite2 database from MaxMind under MaxMind's terms; that is part of WooCommerce, not this plugin.

Changelog

0.1.1

Security: crawler User-Agents may browse but never buy or pay; CDN country and IP headers are honoured only from trusted proxies (off by default); REST and WooCommerce endpoint exemptions follow what WordPress actually routed; optional reverse-DNS verification of Googlebot and Bingbot.
The block page's styles are registered and printed through WordPress, and settings forms read and sanitise each declared field.

0.1.0

First release for any WordPress site: country and region-preset rules, always-blocked countries, IP allowlist (IPv4/IPv6 CIDR), crawler allowlist, branded block page or redirect, business hours, maintenance window, CDN/web-server geolocation, bundled country list, page-cache helper, headless check endpoint and extension hooks.
With WooCommerce: checkout and add-to-cart guards (classic and Checkout block) and WooCommerce/MaxMind geolocation. With HULO Payments: payments from blocked visitors are refused.