Block or allow access by country

Reviewed on September 8, 2026 2 min read firewall bloqueo por paises

You can limit visits from certain countries per domain from the client area. The classification is based on the IP's estimated location, so it does not identify the visitor's nationality and may change or be inaccurate, especially with VPNs, proxies and mobile networks.

Set up the block

Go to the client area and open your hosting service.
Go to Firewall and antivirus > Geo-blocking.
Select the domain you want to protect.
Choose one of the two available modes:

Blacklist: blocks the selected countries and allows the rest.
Whitelist: allows only the selected countries and blocks the rest.

Select at least one country, save the settings and check access from the locations you need.

You can also select by continent. Check the countries included before saving, because a whitelist that is too narrow can block administrators, customers, external services or monitoring systems.

Security limitations

Geo-blocking reduces unwanted traffic, but it does not replace updates, unique passwords, 2FA, login attempt limits or a web application firewall. An attacker can use an IP from an allowed country.

The rule applies to the whole domain, not just to an admin path. Before enabling it, check whether the website uses APIs, payment gateways, webhooks, a CDN, uptime checks or other services that may connect from different countries.

You can remove the settings from the same section to allow all countries again.

If a legitimate visitor can no longer get in

Check the exact domain, the selected mode and the public IP they connect from. In a whitelist, adding countries allows their connections; in a blacklist, adding them blocks them. Switching modes while keeping a selection without reviewing it can reverse the expected result.

If you use a CDN or proxy, confirm that the server identifies the original IP before attributing the country to the visitor. For a block after the change, temporarily remove the rule from the panel, check access and then adjust only what is needed. Do not block countries as a substitute for restricting access to a specific admin URL.