We configure IP blocking or country-level access restrictions at the server level through your control panel — useful for blocking a specific known bad actor, or restricting access from regions where you have no legitimate business and are seeing disproportionate malicious traffic.
IP blocking & country restriction at host
Specific IPs or countries blocked at the server level, checked against legitimate traffic first.
- Full backup taken before we start
- If we can’t fix it, you get your money back
- We never ask for your own password
What we need from you
- Access to your hosting control panel’s IP or geo-blocking settings
- The specific IP addresses or countries to block, or the criteria for deciding
- Confirmation this won’t block legitimate visitors or business operations you’re not currently aware of
This or something else?
| You want specific IP addresses or entire countries blocked at the server level | This fix covers it |
| You want hotlink or leech protection instead, a different kind of access restriction | Hotlink protection & leech protection setup |
| You want a broader web application firewall, not just IP or country blocking | Firewall (WAF) plugin configuration, in the Security, Access & Backups bucket |
| Your host’s control panel doesn’t offer this level of access control | Worth confirming your specific hosting setup — a firewall plugin or CDN-level blocking might be the realistic alternative |
What we do
- Confirm the specific IPs or countries to block and the reasoning
- Configure the restriction through your control panel’s available settings
- Verify legitimate access from allowed locations continues working correctly
- Test that blocked IPs or countries are genuinely restricted
- Monitor initial results to confirm no legitimate traffic is inadvertently affected
- Document the configuration and reasoning for future reference
What is included
- IP or country-level blocking configured as specified
- Verified continued legitimate access from allowed locations
- Tested confirmation of genuine blocking
- A written note on the configuration and reasoning
Not included
- Broader web application firewall configuration, a separate, related fix
- Configuring this where your host’s control panel doesn’t support this level of restriction — an alternative approach would be worth discussing
- Ongoing adjustment as new threats or legitimate access needs emerge
- Investigating or pursuing whoever is behind malicious traffic being blocked
Questions about this fix
Could blocking a whole country accidentally block legitimate customers?
Yes, this is a genuine risk worth thinking through carefully — if you have any legitimate business, customers, or even occasional visitors from a region you're considering blocking, that's worth weighing against the malicious traffic you're trying to stop.
Is IP blocking effective against a determined attacker?
It's effective against a specific, known IP, though a determined attacker can switch IP addresses relatively easily — it's a useful, immediate response to a specific threat rather than a permanent, comprehensive solution.
How do I know which countries or IPs to actually block?
We'd work from whatever evidence you have (server logs, security plugin reports) showing where problematic traffic is genuinely originating, rather than blocking broadly based on assumption.
Will this affect my search engine rankings if I block a country?
Blocking a country you have no legitimate audience in generally shouldn't affect rankings meaningfully, though it's worth being deliberate about this rather than blocking somewhere you might have genuine future interest.
Can this be undone easily if I change my mind?
Yes, removing or adjusting a blocking rule is generally straightforward once configured, should your needs or circumstances change.
Related fixes
If this is the second time this year
A bad update breaking the site is a symptom of updates not being tested first. Care plans run every update on a staging clone before it reaches your live site, which is the actual fix for this happening again.
Your access, your rules
Create a separate admin account for us and delete it when we are done. For anything else, we get in touch and agree a method — never a form field on this site, never by reply to an email.
We back up first, always
Before anything is touched we take a full backup and keep it for 30 days. If a fix goes wrong, we put the site back exactly as it was.
If it is not what you bought
If the problem turns out smaller than what you ordered, we refund the difference. If it is bigger, we stop and send a quote before doing any extra work.
If we cannot fix it
You get back what we received. Diagnosis is on us — you only pay when the problem is actually solved. The payment processor takes its fee before the money reaches us, so we never hold it and it is not ours to return. That is true here as everywhere else.
If it comes back
Reply within seven days of delivery and we put it back on the bench at no cost. The fix is not finished until it holds.
What we are responsible for
If something goes wrong with a fix, our responsibility is limited to what you paid for it. We take a full backup first so mistakes can be undone, and we tell you before doing anything outside what you bought.