WordPress Country Blocking Standard

One-Time Setup (First Site Only)

Create a MaxMind Account

  1. Go to https://www.maxmind.com/en/geolite2/signup
  2. Sign up using the Flourish business email
  3. Confirm the email and set a strong password

This account is reused for all client sites. You only do this step once.

Per-Site Setup (Every New Site)

Step 1: Download the GeoLite2 Country Database

  1. Log in to your MaxMind account
  2. In the left sidebar, click Download Files (under the GeoIP2 / GeoLite2 section). Direct URL: https://www.maxmind.com/en/accounts/current/geoip/downloads
  3. Find the row labeled GeoLite2 Country (not City, not ASN)
  4. Click Download GZIP in that row
  5. Save the file to your computer (it will be named something like GeoLite2-Country_YYYYMMDD.tar.gz)
  6. Extract the file (double-click on Mac; use 7-Zip or similar on Windows)
  7. Inside the extracted folder, locate the file named GeoLite2-Country.mmdb. That’s the only file you need.

Note: Ignore any prompts from MaxMind about generating a license key or setting up GeoIP Update. Those are for automated command-line tools that IQ Block Country does not use.

Step 2: Install IQ Block Country

  1. In the WordPress admin, go to Plugins > Add New
  2. Search for “IQ Block Country”
  3. Install and activate the plugin by Pascal
  4. Go to Settings > IQ Block Country

Step 3: Upload the GeoLite2 Database to the Site

The IQ Block Country plugin cannot auto-download the MaxMind database due to a license conflict between MaxMind’s license and the WordPress plugin repository. You must upload it manually.

Upload destination: /wp-content/uploads/ (the file goes directly in that folder, with its original filename GeoLite2-Country.mmdb)

Upload method (choose one):

  • FTP/SFTP (FileZilla, Transmit, etc.): Connect to the site, navigate to /wp-content/uploads/, and drag the GeoLite2-Country.mmdb file into the folder.
  • Host file manager (cPanel, SiteGround Site Tools, WP Engine User Portal, etc.): Log in to the hosting control panel, open the file manager, navigate to public_html/wp-content/uploads/, and use the Upload button to add the file.

Verify the upload: Go back to WordPress admin > Settings > IQ Block Country. On the Home or Tools tab, you should see a message confirming the GeoIP database was detected, with a date stamp.

Step 4: Configure Frontend Blocking (Public Site)

  1. Click the Frontend tab (may be labeled “Block visitors”)
  2. Choose “Block all countries except those selected below” (the whitelist/inverse-selection option; exact wording varies by version)
  3. Select these countries from the list (Ctrl/Cmd+click to multi-select):
    • United States
    • Canada
  4. Paste the standard block message (see Step 6 below), updating the contact email for the client
  5. Check “Allow search engines to bypass the country block” (critical for SEO)
  6. Save Changes

Step 5: Configure Backend Blocking (wp-admin and Login)

  1. Click the Backend tab (may be labeled “Block admin” or “Block wp-admin”)
  2. Choose the same “block all except selected” option
  3. Select only:
    • United States
  4. Enable blocking for wp-login.php
  5. Go to the Whitelist IP tab and confirm your current IP is listed (the plugin usually adds it on activation; double-check to avoid locking yourself out)
  6. Save Changes

Step 6: Standard Block Message

Use this as the frontend block message, updating the contact email per client:

We’re sorry, but this website is currently only available to visitors from select regions. If you believe you’ve reached this page in error, please contact us at [client-email@domain.com] and we’ll be happy to help.

Step 7: Test the Configuration

  1. Open an incognito window and load the site from your normal location to confirm it loads normally
  2. Go to https://geopeeker.com, enter the site URL, and check how it loads from Germany, Singapore, or Brazil. Those should show the block message.
  3. Run the site through Google’s Rich Results tool (https://search.google.com/test/rich-results) to confirm Googlebot is not blocked
  4. Log into wp-admin from your normal location to confirm you are not locked out
  5. Check the plugin’s Statistics or log tab after 24 hours to confirm blocks are happening

Travel and Whitelist Procedures

When You (Flourish) Travel Internationally

Before leaving, choose one of these approaches:

Option A: IP whitelist (best for stable connections)

  1. Once you know where you’ll be working from (hotel, rental, coworking space), get your IP at https://whatismyipaddress.com
  2. Log into wp-admin before you leave, or use a US-based VPN to get in from abroad
  3. Go to Settings > IQ Block Country > Whitelist IP tab
  4. Add the IP with a dated comment (e.g., “Jackie travel 2026-05-15 to 2026-05-30”)
  5. Remove the entry when you return

Option B: Temporarily allow the country (best for changing locations)

  1. Before leaving, log into wp-admin and add the destination country to the Backend allow list
  2. Remove it when you return
  3. Document the change in the client’s maintenance log

Option C: Static-IP VPN (best long-term solution if you travel often)

A VPN service with a dedicated US exit IP lets you connect as if you’re home, no whitelist changes needed. NordVPN, ProtonVPN, and Mullvad all offer dedicated IPs as an add-on for a few dollars a month. Once set up, whitelist that one static IP across all client sites and you’re covered indefinitely.

Emergency Lockout Recovery

If you get locked out (whitelisted IP changed, forgot to add the country, etc.):

  1. Access the site via FTP/SFTP or the host file manager
  2. Navigate to /wp-content/plugins/
  3. Rename iq-block-country to iq-block-country-OFF
  4. Log in to wp-admin, adjust settings as needed
  5. Rename the folder back to iq-block-country to re-enable

Whitelisting Someone Else (Client, Vendor, Traveling Patron)

  1. Ask them for their IP from https://whatismyipaddress.com
  2. Add it on the Whitelist IP tab with a dated comment
  3. Remove when no longer needed

Allowing a Country Temporarily

If the client has an event drawing visitors from a specific country (e.g., a UK-based touring show):

  1. Add the country code to the Frontend allow list before the event
  2. Remove it after the event ends
  3. Document the change in the client’s maintenance log

Maintenance

  • Database updates: MaxMind releases updates to the GeoLite2 Country database roughly monthly. Since the plugin cannot auto-update, manually re-download and re-upload the .mmdb file quarterly. Add this to the client’s recurring maintenance checklist.
  • Log review: Every 60 to 90 days during regular maintenance, check the plugin statistics to confirm blocks are happening and that the volume is reasonable.
  • Client offboarding: If a client relationship ends, no external cleanup is needed. The database file and plugin remain with the site.

Troubleshooting

Problem: Site owner or editor is locked out of wp-admin Fix: Use the emergency lockout recovery procedure above (rename the plugin folder via FTP).

Problem: Googlebot or Bingbot is being blocked (SEO impact) Fix: Confirm “Allow search engines to bypass” is enabled on the Frontend tab. The plugin verifies bots by reverse DNS, so legitimate bots are allowed automatically once this is on.

Problem: Plugin says the GeoIP database is not detected after upload Fix: Confirm the file is named exactly GeoLite2-Country.mmdb (not the full dated filename) and is placed directly in /wp-content/uploads/. Some plugin versions may also check /wp-content/uploads/iq-block-country/ as an alternate location.

Problem: GA4 still shows international bot traffic after install Fix: Some bots execute JS before the PHP block fires. For persistent issues, add a complementary GA4 filter to exclude known bot traffic, or consider moving that specific site to an edge-level solution.

Problem: Only checkboxes are visible on the Frontend/Backend tab, no “allow/block” toggle Fix: Look for an “Inverse selection” or “Block all except selected” option. If truly absent, update the plugin to the latest version.

Client Documentation Note

When adding this to a client site, note it in the maintenance spreadsheet under a new column or in the site’s handoff notes so future sessions know country blocking is active. This prevents confusion if traffic ever drops unexpectedly. Also add a recurring quarterly reminder to re-upload the GeoLite2 database.