Block Countries in WordPress for Free, Without Wordfence

The walkthrough

What country blocking stops, and what it does not
The options side by side
Option A: a Cloudflare rule
Option B: block countries in WordPress for free with AdminEase
Test it from outside

1. What country blocking stops, and what it does not

A large share of automated login attempts, comment spam and vulnerability scanning comes from a handful of networks. If you sell only in Europe, nobody in a country you do not ship to has a reason to load your login page, and refusing them cuts that noise at no cost to real customers.

That is the whole benefit, and it is worth being clear about the limits:

A VPN walks straight past it. Anyone who wants in from a blocked country can pick an exit in an allowed one in seconds. Country blocking removes bulk traffic, not a determined attacker.
It does nothing about attacks from allowed countries, which includes most compromised servers and most botnets, since those run on ordinary hosting everywhere.
It does not patch anything. A vulnerable plugin is exactly as vulnerable to a visitor from an allowed country.
It blocks real people too. Your customer on holiday, your developer abroad, and a search engine crawling from a data centre in a blocked country all get the same 403.

Use it to reduce noise. Keep your plugins updated, use two-factor on admin accounts, and treat it as one layer rather than the security plan.

2. The options side by side

.tutorial-article .pwp-compare { width: 100%; border-collapse: collapse; } .tutorial-article .pwp-compare th, .tutorial-article .pwp-compare td { color: #e8ece9 !important; padding: 12px 14px; border: 1px solid rgba(255,255,255,0.18); vertical-align: top; text-align: left; } .tutorial-article .pwp-compare thead th { color: #ffffff !important; font-weight: 700; background: rgba(255,255,255,0.06); } .tutorial-article .pwp-compare td:first-child { color: #ffffff !important; }

	Wordfence Free	Wordfence Premium	Cloudflare Free	AdminEase Free
Country blocking	No	Yes	Yes, as a custom rule	Yes
Where it blocks	Not available	On your server	At Cloudflare, before your server	On your server
Web application firewall	Yes, rules 30 days behind Premium	Yes, real-time rules	Yes, managed rules vary by plan	No
Cost	Free	$149 a year, one site	Free, 5 custom rules	Free

Two things the table makes plain. If you are already on Cloudflare, that is the better place to block, because the request never reaches your server at all. And Wordfence Premium is not only country blocking: the $149 also buys real-time firewall rules, which the free version gets 30 days late. If you want that, it is a fair price. If you only want to refuse a few countries, you do not need to pay for it.

3. Option A: a Cloudflare rule

If your site already runs through Cloudflare, do it there and skip AdminEase for this.

Create the rule: in the Cloudflare dashboard, open your domain, then Security and the WAF Custom rules tab, and create a rule matching on Country, with the action set to Block. The free plan includes five custom rules, and one rule can list as many countries as you like.

(ip.src.country in {"KP" "SY"})

That is Cloudflare's own documented example, as the expression the rule builder produces. Use the two-letter ISO code for each country.

4. Option B: block countries in WordPress for free with AdminEase

If you are not on Cloudflare, or want the setting to live inside WordPress, AdminEase does it in the free plugin. First, AdminEase has to be able to tell where a visitor is. It reads that from Cloudflare's country header or from the PHP GeoIP extension on your server. With neither, the toggle reports "Unfortunately your server does not support this feature" and cannot be turned on.

On Cloudflare, switch on IP Geolocation first Cloudflare only sends the country header when IP Geolocation is enabled, and it is off by default on every plan. Turn it on under Network in your Cloudflare dashboard. Without it, your site can be on Cloudflare and still have no country data to block on.

Open the setting: AdminEase › Security › Access Control, and turn on Enable country blocking.

Pick the countries: choose them in Block specific countries. The country you are browsing from right now is left out of the list, so you cannot block yourself by accident while setting it up.

Keep the right doors open: in Exclude paths from country blocking, add any path that must stay reachable from anywhere, one per line. Payment webhooks and outside services calling your REST API are the usual ones: /wp-json/, /wp-admin/admin-ajax.php, /wp-cron.php.

Logged-in admins are not exempt The block applies to everyone, including administrators, so the rule behaves the same on every type of server. The own-country guard only protects you while you are setting it up. If you or another admin later travels to a blocked country, the login page returns a 403. Exclude /wp-admin/ and /wp-login.php if that is likely.

Save, and AdminEase writes the block into .htaccess on Apache and LiteSpeed, or enforces it in PHP on Nginx, where .htaccess is not read. A blocked visitor gets a plain 403 Forbidden. Scheduled tasks and WP-CLI are never blocked.

AdminEase Pro adds three optional controls on top: Whitelisted IP Addresses, Allow common bots and Allow specific bots, for letting a known office address or a search engine through a country you otherwise block. Country blocking itself is free. For choosing between Cloudflare and GeoIP, and installing GeoIP on your own server, see the full geo-blocking walkthrough.

5. Test it from outside

Do not trust the saved setting. Check it.

Connect a VPN to one of the countries you blocked, open your site in a private window, and load the home page.

Expect a 403: you should see a bare Forbidden page. If your site loads normally, the block is not being applied, which almost always means the country data is missing. On Cloudflare, check IP Geolocation again.

Then check an allowed country, and your excluded paths, so you know you have not blocked more than you meant to.

Where to go from here

Country blocking is a cheap way to reduce the traffic you have to worry about, and a poor substitute for anything else. AdminEase is not a firewall and does not scan for malware. If you want those, Wordfence Premium is a reasonable purchase and the $149 covers more than country blocking. If all you wanted was to turn a few countries away, you now have that for free. The AdminEase hardening checklist covers the other free settings worth turning on while you are there.

Frequently asked questions

Is country blocking free in Wordfence?

No. Wordfence's own plugin listing marks it as a Premium feature. Premium was $149 a year for one site when this was written.

Is AdminEase a Wordfence alternative?

For country blocking, yes. For the rest of Wordfence, no. AdminEase has no firewall, no malware scanning and no two-factor authentication. It blocks countries and bots and applies hardening settings.

Why is the toggle greyed out?

AdminEase cannot see visitors' countries. Put the site behind Cloudflare with IP Geolocation on, or ask your host for the PHP GeoIP extension.

I blocked a country and nothing changed. Why?

Usually the country data is not arriving. On Cloudflare, IP Geolocation is off by default. Turn it on under Network, then test again with a VPN.

Will it block Google?

It can, if Google crawls from a data centre in a country you blocked. Most sites never notice, but if search traffic matters, keep the blocked list short, or use Pro's bot allowlist.

Can I lock myself out?

Not while setting it up: your current country is removed from the list. Later, yes, if you travel to a blocked country, because admins are not exempt. Exclude /wp-admin/ and /wp-login.php if that could happen.

Settings reference

This setting has a reference page: Block specific countries. For the wider picture, including bot blocking and the other access rules, see the geo-blocking and bot protection guide.