Magento Country Blocker: Step-by-Step Guide to Blocking Countries

Magento 2 Country Blocker is the best solution to block unwanted traffic from regions you do not serve instead of blocking specific IPs in Magento. It detects visitors' locations and restricts access based on configured rules, while keeping the storefront accessible for everyone else. Magefan Bot Blocker uses IP geolocation detection to enable country-based restrictions for countries you want to block or show a CAPTCHA challenge for visitors from those countries.

This guide explains what a country blocker is, how it works and how to configure it in your Magento 2 store directly from the admin.

What is a Magento Country Blocker?

Magento country blocker is a feature of the Magento 2 Spam and Bot Blocker that uses IP geolocation detection to identify visitors' countries and restrict access to the Magento storefront from specific countries. This feature works by matching visitors' IP addresses with the built-in Geo IP database to check whether the visitor should be allowed to access the website.

The difference between country blocking and an IP blacklist is that the latter targets specific addresses and ranges, while country blocking applies to broader ranges of IPs associated with entire countries or regions.

Country Blocking vs. Magento Allowed Countries

Magento Allowed Countries setting (via Stores > Configuration > General > General > General > Country Options) doesn't block website access. It determines which countries are available for certain store operations, e.g. customer addresses, delivery methods etc. If you want to prevent users from specific countries from accessing your frontend or backend, you need Magento Country Blocker and other IP blocking tools.

Default Magento allowed countries settings

How Does Magento IP Location Country Blocking Work?

Magento IP country blocking detects approximate visitor location through their IP address and applies the configured country restriction. The process is as follows:

The extension detects the visitor's IP and runs it through the Geo IP database.
The country is identified and checked against the country blocking rule.
Access is allowed or denied based on the restriction rules.

Magefan Bot Blocker extension uses its own Geo IP database and offers Cloudflare and MaxMind integration to detect countries properly.

Note: IP geolocation blocking can be affected by VPNs, proxies or gateways, so it shouldn't be used as the only access-control measure blocking unwanted traffic.

How to Block Specific Countries in Magento 2?

To block specific countries in Magento 2, enable Country Blocking option under Stores > Configuration > Magefan Extensions > Bot Blocker. Then select the countries you want to restrict in the Blocked Countries field.

Magefan country blocker settings

Once you save the configuration, both visitors and bot traffic from selected countries will be subject to the country blocking rule. So they won't be able to access your backend or storefront.

How to Test Country Blocking in Magento?

Magefan Spam and Bot Blocker Extension comes with a Geolocation Simulator, which allows you to test the configuration before enabling it on a live store.

Important: use a VPN to simulate a country for testing, since the system will block access to a simulated country, potentially blocking you out of your store if you use your current IP and country.

To test country blocking in Magento, select a country in the Blocked Countries field. Then go to Stores > Configuration > Magefan Extensions > GeoIP Database > Developer (Simulate Geolocation), and specify the Simulate Country and a test IP in the Allowed IPs field.

Magefan location simulator for testing country blocking

After you hit Save, the system will block the selected country from the backend and frontend.

Blocked access message shown on frontend once the country is blocked

Note: clear the Allowed IPs field in the location simulator and the Blocked Country from the Country Blocker settings, in order not to block access to some employees or visitors after testing.

How to Block Bot Traffic by Country in Magento?

If you want to allow legitimate users from all countries and block only suspicious bots by country in Magento, use Magefan's Wholesite reCAPTCHA setting. Navigate to Stores > Configuration > Magefan Extensions > Bot Blocker > reCAPTCHA > Wholesite reCAPTCHA.

Note: First, you need to configure a reCAPCTHA Provider in the Keys section for the Wholesite CAPTCHA to work.

Here you have three Modes to choose from: Always on, Always on (for specific countries), or Auto enable (on high load). All modes allow you to choose specific countries reCAPTCHA should apply to.

Always on — the CAPTCHA challenge will always be displayed for every visitor from selected countries.
Always on (for specific countries) — the CAPTCHA challenge will be displayed only for selected countries, with the option to exclude or use CAPTCHA on specific URLs.
Auto enable (on high load) — the CAPTCHA challenge will be enabled only on high volumes of requests from selected countries.

Example of the reCAPTCHA settings for specific countries in Magefan Bot Blocker

Best Practices for Restricting Traffic by Country in Magento

Country blocking may be useful in Magento if you don't sell in specific regions and want to block both human and bot traffic from specific regions entirely. However, it should be applied carefully to avoid unnecessary access issues.

Review traffic before blocking: use server logs and security reports to understand where unwanted traffic comes from and block a country only when there is a reason for it.
Consider VPNs and proxies: some legitimate visitors or developers may appear to be from another country because of VPNs, mobile networks or proxies.
Combine spam protection settings: use country blocking along with IP restriction rules, CAPTCHA, and rate limiting for the best experience.
Test blocked countries: use location simulation to check whether legitimate users can still access your store when expected.

IP location country blocker in Magento gives store owners an easy way to block unwanted traffic from specific countries directly from the admin panel. With Magefan Bot Blocker, you can enable country blocking for selected countries and test the settings with the location simulation. However, according to Magento security best practices, you should combine country restrictions with other settings.

FAQs

Does Magento 2 have a built-in country blocker?

Magento offers country settings only for store configuration and customer-related address settings, like delivery and payment options on checkout. To block specific countries from accessing both the backend and frontend, a dedicated Magento 2 country blocker is required.

How to block traffic from specific country in Magento 2?

To block traffic from specific countries, you need to identify malicious countries or IPs using the traffic monitor in the Magefan Bot Blocker and then block entire countries or specific IPs through the Country Blocking or Access List settings.

How to block all traffic from China, russia in Magento?

To block all bots from China or russia from crawling your Magento 2 store, block those countries from accessing your store entirely using Geo Country Blocker available as part of Magefan's Bot Blocker Extension.

Does country blocking stop all malicious traffic?

Country blocking restricts access to Magento frontend and backend from specific countries. Malicious visitors may use proxies, VPN or dynamic IPs to manipulate geolocation data. To block malicious traffic entirely, it's recommended to combine country blocking with other security tools, e.g. reCAPTCHA, rate limiting.