Country Blocking for a Site

Country filtering lets you block visitors from selected countries, or allow only selected countries, enforced at the server on each visitor's IP address. This guide covers the two modes, how to set them up safely, what the feature can and cannot do, and why it can never lock you out of KPanel.

Where Country Filtering Lives in KPanel

Country filtering has no entry of its own in the site tab strip. You reach it through the site's Security page:

Sign in to KPanel.
Click Websites in the left sidebar, then click the site.
Open the site's Security page. On a WordPress or WooCommerce site that is WordPress, then Security. On a static, PHP, Node.js, Python, or Ruby site it is Advanced, then Security.
Find the Country IP filtering card and click Configure.

The direct address is /websites/<site-id>/security/geo-block.

Country IP filtering for a site in KPanel

The Security page card also summarises the current state without opening the full page: how many countries are selected, and whether they are being blocked or allowed.

The Two Modes

Block selected. All traffic is allowed except visitors from the countries you tick. Use this to shut out a specific source of abuse while leaving the site open to everyone else. This is the safe default and the right choice most of the time.

Allow only selected. All traffic is blocked except visitors from the countries you tick. Use this when a site genuinely serves one market and nowhere else, for example an internal tool or a regionally licensed service.

Blocked requests receive an HTTP 403.

Allow-only mode is a much bigger hammer than it looks. It blocks search engine crawlers, uptime checkers, payment provider callbacks, and webhook senders that happen to originate outside your allowed list, not just human visitors. If you use it, expect to add countries you did not think of, and watch your traffic afterwards.

Setting It Up

Open the country filtering page.
Choose Block selected or Allow only selected.
Use the search box to find countries by name or two-letter code, and click each one to tick it. The header shows a running count and a Clear all link.
Click the button at the bottom, which reads Apply to the number of countries you have chosen.

Rules take effect at the server the moment you save. There is no propagation delay and no cache to wait for.

Any unsaved change is flagged with an Unsaved changes note next to the button, so you cannot leave a half-made rule assuming it applied.

The Empty-Allow-List Guard

Allow-only mode with zero countries selected would mean "allow only these zero countries", which is the same as blocking every visitor on earth and taking your site completely offline.

That combination is refused. If you try to save it, you get an error telling you to add at least one country or switch back to block mode. The refusal happens in the browser and again on the server, so there is no path to accidentally applying it.

To turn filtering off entirely, clear all countries while in Block selected mode and save. The button changes to Clear rules, and afterwards all traffic is allowed again. The page confirms this: with no countries selected, all traffic is allowed.

You Cannot Lock Yourself Out of KPanel

This is the question everyone asks, and the answer is reassuring.

KPanel is served from its own separate domain. A country rule you create here applies to your website, not to the control panel, so even a rule that blocks your own country never affects your ability to sign in, edit the rule, or remove it.

The worst case is that you block yourself from your own website, and you fix that in KPanel in a few seconds.

What It Can and Cannot Do

Country filtering is enforced on the visitor's IP address, which makes it accurate for ordinary traffic and easy to work around for anyone who wants to.

It will:

Cut a large amount of automated scanning and low-effort abuse originating from a specific country.
Reduce load and log noise from regions you do not serve.
Enforce a straightforward geographic access policy.

It will not:

Stop a determined attacker. Anyone on a VPN or a proxy appears to be somewhere else, and the page says so plainly.
Enforce a legal or licensing boundary reliably. Do not treat it as compliance.
Distinguish a legitimate visitor travelling abroad from an unwanted one. A customer on holiday gets a 403.

Treat it as a coarse filter that reduces volume, not as a security boundary. For a real boundary, use authentication: see Password-Protecting a Site.

Combining It With Other Controls

Country filtering is one of several access controls on the same site, and they stack:

IP blocking targets individual addresses or ranges. Better when you know exactly who the problem is. See Site Security.
Login brute-force protection watches failed sign-in attempts and bans the source automatically, which handles the most common attack without any geography at all.
Password protection requires credentials from everyone, everywhere, and is the only one of these that is genuinely a boundary.
Hotlink protection stops other sites embedding your media, which is a bandwidth problem rather than an access one.

If your actual problem is brute-force attempts against a WordPress login, login hardening is already handling it and country filtering adds little. If your problem is scraping, country filtering plus hotlink protection is a reasonable pair.

Troubleshooting

Legitimate visitors report a 403. Check whether their country is in your block list, or missing from your allow list. Travelling customers and mobile networks that route through another country are the usual explanations.

Search traffic dropped after enabling allow-only mode. Crawlers reach you from outside your allowed countries and are being blocked. Either add the countries the crawlers use, or switch to block mode and list only the countries you actually want gone.

Uptime monitoring started failing. The checker is being blocked. See Site Uptime Monitoring, where the incident reason will show the 403.

Payment or webhook callbacks stopped arriving. Third-party services call your site from their own infrastructure, wherever that is. Allow-only mode is the usual culprit.

The save failed with a message about the server. The rule could not be applied, and your previous setting was restored rather than left half-applied. Try again, and if it keeps failing, open a ticket.

I want to block a single abusive address, not a country. Use the IP block list on the site's Security page instead. It is far more precise and has none of the collateral damage.

Site Security for the full security page, including IP blocking and login hardening.
Password-Protecting a Site when you need a real access boundary.
Site Traffic Analytics to see which countries your traffic actually comes from before you block any of them.