To block a country in WordPress with Security Ninja Pro, turn on Cloud Firewall and select the countries under Firewall settings. Requests that reach PHP are checked, including login, forms, and admin-ajax.php. This is useful when abuse concentrates in regions you do not serve.
Cloud Firewall must be enabled. The control is on Security Ninja → Firewall → Settings.
Be careful blocking the United States. Many Googlebot crawls come from US IPs. Blocking the USA can hurt search indexing.
Steps
- Go to Security Ninja → Firewall → Settings.
- Find Block visits from these countries.
- Search or scroll to select countries. Remove a country with the x next to its name.
- Use Select All / Select None for bulk changes when available.
- Save settings.
How it works
Visitor IPs are looked up with IP2Location LITE data stored on your site. Matching countries are blocked. Country rules use the same visitor IP as bans and logging, so if lookups look wrong behind Cloudflare or a proxy, set Visitor IP detection first.
You can show a message or redirect blocked visitors.
This product includes IP2Location LITE data available from https://lite.ip2location.com.
Login forms and stores
You can limit country rules to login forms. When that option is on, WooCommerce login and registration are included, and a blocked country cannot sign in through SureCart either. Storefront browsing stays open unless you block the whole site. Store limits are separate: WooCommerce and SureCart store protection.
Satellite and residential ISPs
Some satellite ISPs, including Starlink, share address space that can look like a blocked country or a hit on the cloud bad-IP list. Soften satellite connections is on by default under Firewall → Settings.
When the visitor’s network (ASN) matches, country blocking and the cloud reputation list are softened for that IP. Manual blocks, login limits, and Filter Suspicious Queries are unchanged.
The default ASN is Starlink, 14593. Add others as comma or space separated numbers if you need them. The ASN is looked up only when that visitor would otherwise be blocked, then cached for the IP.
Limitations
Country blocking applies to requests that reach PHP, including login, forms, and admin-ajax.php. A page cache such as WP Rocket, or a host cache such as LiteSpeed, Varnish, or nginx, can still send a saved HTML page before Security Ninja runs.
Early Firewall does not look up country. It still blocks banned IPs and suspicious queries before WordPress loads.
VPNs and proxies can make a visitor appear to be in another country. Treat country blocking as one layer. Combine it with firewall rules, login protection, and security tests.
