How to Block a Country's IP Addresses from Your Website

Spam form submissions spiking from one region. Brute force login attempts concentrated in a specific country. Bot traffic inflating your analytics from locations that will never convert.

Country-level IP blocking is one of the most direct and effective responses to these problems. By adding an access control list (ACL) to your .htaccess file, you can block — or exclusively allow — visitors from specific countries at the server level, before they ever reach your application.

Here's how to do it cleanly and correctly.

How Country IP Blocking Works

Every device connected to the internet has an IP address. These addresses are allocated by regional internet registries and assigned to specific countries. By obtaining the full list of IP ranges assigned to a country and adding deny rules to your .htaccess file, your server rejects connection requests from those IP ranges before serving any content.

This works at the Apache web server level — meaning it's fast, lightweight, and requires no plugin or application-layer processing. It's one of the most efficient forms of traffic filtering available on standard web hosting environments.

When to Use Country IP Blocking

Country IP blocking is the right tool when:

• You're receiving sustained spam, scraping, or brute force attacks from specific regions
• Your business only operates in specific markets and international traffic adds zero value
• You need to comply with legal or licensing restrictions that prevent serving users in certain jurisdictions
• Your site is being used to distribute content to regions where it's not authorized

It's not a complete security solution — determined attackers use VPNs and proxies — but it significantly reduces automated attack surface with minimal effort.

Step 1: Generate the Country's IP Address List

You need a complete list of IP ranges assigned to the countries you want to block. The most reliable free tool for this is Country IP Blocks.

1. Visit countryipblocks.net/acl.php
2. Select the countries you want to block or allow from the list
3. Under Select Format, choose the correct output format:
   • Apache .htaccess Deny → if you want to block those countries
   • Apache .htaccess Allow → if you want to whitelist those countries and block everyone else
4. Click Create ACL
5. The generated ACL appears on the right side of the screen
6. Click Copy ACL to Clipboard

If using the Allow format: Add deny from all as the very first line above your list of allowed IPs. Without this line, the allow rules have nothing to override — everyone gets through regardless.

The output will look something like this for a deny list:

deny from 1.0.0.0/24
deny from 1.0.1.0/24
deny from 1.0.2.0/23
deny from 1.0.4.0/22

And like this for a whitelist (allow only specific countries):

deny from all
allow from 1.0.0.0/24
allow from 1.0.1.0/24
allow from 1.0.2.0/23

Step 2: Add the IP List to Your .htaccess File

Once you have the ACL copied, you need to paste it into your .htaccess file. Here's how to do it through your hosting control panel:

Using File Manager (cPanel / hPanel)

1. Log into your hosting control panel
2. Go to Files → File Manager
3. Select your domain and click Go To File Manager
4. Navigate to the public_html folder
5. Locate the .htaccess file — if you can't see it, enable hidden files in File Manager settings
6. Right-click → Edit (or double-click to open the editor)
7. Paste your ACL at the top of the file, above any existing rules
8. Click Save & Close

Using FTP

If you prefer working via FTP (FileZilla or similar):

1. Connect to your server via FTP
2. Navigate to public_html
3. Download the current .htaccess file to your local machine
4. Open it in a text editor (VS Code, Notepad++, etc.)
5. Paste the ACL at the top of the file
6. Save and re-upload — overwrite the existing file

Always back up your .htaccess file before making changes. A malformed .htaccess can take your entire site offline. Keep a copy of the original so you can restore it instantly if needed.

What Your .htaccess File Should Look Like

Here's an example of a correctly structured .htaccess file with a country block applied:

# Block specific country IP ranges
deny from 1.0.0.0/24
deny from 1.0.1.0/24
deny from 1.0.2.0/23
deny from 1.0.4.0/22
deny from 1.0.8.0/21

# Existing WordPress rules below
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

Keep your IP block rules above the WordPress rewrite rules to ensure they're processed first.

Blocking vs. Allowing: Which Approach to Use

The deny approach is safer for most use cases. The allow approach is appropriate only if you're certain your entire legitimate audience comes from a defined set of countries.

Important Limitations to Know

Before implementing country IP blocking, understand what it cannot do:

• VPN and proxy users bypass it — IP blocking works on the assigned IP, not the actual user location. Anyone using a VPN or proxy appears to come from a different country
• IP ranges change over time — country IP allocations are updated periodically. Your block list will become partially outdated over time and should be refreshed every 6–12 months
• Large block lists affect performance slightly — very large ACLs (thousands of entries) add minor processing overhead on shared hosting. For most sites this is negligible
• It's not a substitute for a WAF — for serious, persistent threats, a Web Application Firewall provides significantly more robust protection

Alternative: Use Cloudflare for Country Blocking

If you're using Cloudflare (recommended for any serious web infrastructure), country blocking is significantly easier and more powerful:

1. Log into your Cloudflare dashboard
2. Select your domain
3. Go to Security → WAF → Firewall Rules
4. Create a new rule:
   • Field: Country
   • Operator: equals
   • Value: [select country]
   • Action: Block
5. Save the rule

Advantages of Cloudflare over .htaccess blocking:

• Automatically updated IP intelligence — no manual refreshing
• Blocks at the network edge before traffic hits your server
• Handles VPN detection more effectively
• Easy to manage via UI — no file editing required
• Free tier covers country-level blocking

For UAE-based businesses looking to control regional access or target specific markets, UAE web development teams increasingly recommend Cloudflare as the standard approach over manual .htaccess rules.

Keeping Your Block List Current

IP address allocations change. A block list generated today will gradually become less accurate as regional registries reassign IP ranges.

Best practice:

• Revisit and regenerate your block list every 6–12 months
• If using .htaccess, replace the old IP block section with the newly generated one
• If using Cloudflare or a WAF, this is handled automatically

Frequently Asked Questions

Will blocking a country's IPs affect my website's SEO? Generally no — search engine crawlers (Googlebot, Bingbot) use US-based IP addresses and won't be affected by country blocks targeting other regions. However, if you block a country where Googlebot's international crawlers operate, you could affect indexing for that region. Avoid blocking Google's crawler IP ranges.

What happens to blocked visitors — do they see an error? By default, blocked visitors receive an HTTP 403 Forbidden error. You can customize this by adding an ErrorDocument 403 directive to your .htaccess pointing to a custom page with a more user-friendly message.

Can I block multiple countries at once? Yes. Simply generate an ACL that includes multiple countries from the Country IP Blocks tool — select all the countries you want to block before clicking Create ACL. The tool combines all selected countries into a single output.

My .htaccess changes broke my site — what do I do? Restore your backup immediately. Connect via FTP, upload the original .htaccess file, and your site will return to normal. Then carefully review the pasted ACL for syntax errors — a single malformed line can cause a 500 error for the entire site.

Is there a limit to how many IP ranges I can add to .htaccess? There's no hard limit, but very large files (tens of thousands of entries) can slow Apache's processing. For large-scale blocking, Cloudflare's firewall rules or a dedicated WAF are more efficient solutions than .htaccess.

Does this work on WordPress specifically? Yes. .htaccess operates at the server level — below WordPress entirely. It works regardless of your CMS. The rules are processed by Apache before WordPress even loads, making it an efficient filtering layer for any WordPress site on Apache-based hosting.