How to Restrict Website Access by Country Using .htaccess

Your website goes live and suddenly it's accessible to anyone on the planet. That's the point — but it also means spammers, scrapers, and bad actors from high-risk regions can reach it just as easily as your real customers.

The good news: you don't need a firewall appliance or a security plugin to fix this. A few lines in your .htaccess file can block — or allow — visitors from specific countries in minutes.

Here's exactly how to do it.

Why Block Traffic by Country?

Country-based IP blocking isn't about being restrictive for no reason. It's a practical security layer for specific situations:

• Your site is being hammered by spam form submissions from specific regions
• You're seeing brute force login attempts concentrated in certain countries
• Your business only operates in specific markets and international traffic adds no value
• You need to comply with regional data regulations

It won't stop every threat — determined attackers use VPNs — but it significantly reduces automated attack surface with almost zero effort.

If you're managing your own web hosting environment, this is one of the first hardening steps worth implementing.

What You'll Need

• Access to your .htaccess file (via File Manager, FTP, or cPanel)
• A list of IP address ranges for the countries you want to block or allow
• 10 minutes

Step 1: Generate the Country's IP Address List

You need a list of IP ranges assigned to the country you want to block. The easiest free tool for this is IP2Location's Visitor Blocker.

1. Go to ip2location.com/free/visitor-blocker
2. Select the country you want to block or allow
3. Choose IPv4 or IPv6 depending on your needs (IPv4 covers the vast majority of traffic)
4. Select the correct Output Format — this changes based on whether you're blocking or allowing:
   • Blocking format → generates deny from rules
   • Allowing format → generates allow from rules
5. Click Download — you'll receive an Access Control List (ACL) file

Important: If you're using the allow format (whitelisting specific countries), add deny from all as the very first line above your list of allowed IPs. Without this, the allow rules have nothing to override and everyone still gets through.

Step 2: Add the IP List to Your .htaccess File

Once you have the ACL file, you need to paste its contents into your .htaccess file. Here's how to do it through a standard hosting control panel:

Using File Manager (cPanel / hPanel)

1. Log into your hosting control panel
2. Navigate to Files → File Manager
3. Select your domain and open the File Manager
4. Navigate to the public_html folder
5. Find and double-click the .htaccess file to open the editor
6. Open your downloaded ACL file, copy all contents, and paste into .htaccess
7. Click Save

Using FTP

If you prefer FTP (FileZilla or similar):

1. Connect to your server
2. Navigate to public_html
3. Download the current .htaccess to your local machine
4. Open it in a text editor and paste the IP rules
5. Upload the modified file back — overwrite the existing one

What the .htaccess Rules Look Like

To block a country (deny specific IPs):

deny from 1.0.0.0/24
deny from 1.0.1.0/24
deny from 1.0.2.0/23

To allow only specific countries (whitelist approach):

deny from all
allow from 1.0.0.0/24
allow from 1.0.1.0/24
allow from 1.0.2.0/23

The whitelist approach is stricter — use it only if your audience is confined to specific markets and you're comfortable blocking everyone else.

Important Limitations to Know

Before you implement this, understand what it can and can't do:

IP geolocation databases are not perfectly accurate — some IPs may be misclassified. For most use cases this is acceptable, but it's worth knowing the limitation exists.

Keeping Your Block List Up to Date

IP ranges change over time. Countries get assigned new blocks, ISPs reorganize, and the list you download today won't be perfectly accurate in 12 months.

Best practice: revisit your block list every 6–12 months and regenerate it from IP2Location or a similar source. If you're running a high-traffic site, consider automating this with a cron job that pulls updated lists on a schedule.

When .htaccess Blocking Isn't Enough

For most small-to-medium sites, .htaccess country blocking is perfectly adequate. But if you're dealing with serious, persistent attack traffic — or running an e-commerce platform handling sensitive customer data — you may need a more robust solution.

Options that go beyond .htaccess:

• Cloudflare Firewall Rules — free tier includes country-level blocking with a proper UI, automatic IP updates, and bypass protection
• ModSecurity — server-level WAF for more granular rule control
• Dedicated security services — enterprise-grade protection for high-value targets

If you're unsure which approach fits your infrastructure, a web development and security review can help you make the right call without over-engineering it.

A Note on Compliance

If you're blocking countries for legal or regulatory reasons — GDPR compliance, sanctions, export controls — .htaccess alone is not a legally defensible solution. It should be part of a broader compliance strategy. Speak to a legal advisor if regulatory compliance is your primary driver.

For businesses operating across multiple markets and needing strategic guidance on how to structure their digital infrastructure, consulting with the right team early saves significant cost and headache down the line.

Frequently Asked Questions

Will this block 100% of visitors from a specific country? No. Users accessing your site through a VPN or proxy server will appear to come from a different country and bypass the block. It's effective against automated bots and casual visitors, but not against determined actors using anonymization tools.

Does .htaccess blocking slow down my website? Minimally. The server checks the IP against your rules before serving any content, which adds a tiny amount of processing overhead. For most sites this is imperceptible. Very large block lists (thousands of entries) may have a slightly more noticeable impact on shared hosting.

Can I block multiple countries at once? Yes. Simply add the IP ranges for each country you want to block into the same .htaccess file, one rule per line. There's no limit to how many countries you can include.

What happens to blocked visitors — do they see an error? By default they receive a 403 Forbidden error. You can customize this by adding an ErrorDocument 403 directive to your .htaccess file pointing to a custom page.

Can I use this to allow only one country and block everyone else? Yes — use the whitelist approach. Add deny from all as the first line, then add allow from rules for every IP range in your target country. Anyone outside those ranges will be denied access automatically.

Do I need a plugin to do this in WordPress? No. .htaccess operates at the server level, below WordPress entirely. It works regardless of what CMS or platform you're running. That said, plugins like Wordfence offer a more user-friendly interface for country blocking if you prefer not to edit server files directly.