WP Manifestindependent plugin directory
manifest / security / ip-blocker-plugin

WP IP Blocker

Block visitors by IP/CIDR and by country (via CDN/host headers). Optional Apache .htaccess integration for IP-only blocking.

by M Moiz · github.com/moizxox/ip-blocker-plugin

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/moizxox/ip-blocker-plugin/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/moizxox/ip-blocker-plugin ↗

A lightweight WordPress plugin to block visitors by IP/CIDR and by country (via CDN/host headers). Optionally writes Apache .htaccess IP rules for server-level blocking.

Features

  • Block individual IPs or CIDR ranges (IPv4/IPv6)
  • Block by country using headers like CF-IPCountry, X-AppEngine-Country
  • Optional Apache .htaccess IP blocking (no country support) for faster server-level deny
  • Minimal UI, simple code, fast and lightweight

How It Works

  • PHP mode: Early hook inspects client IP and country headers, returns 403 for matches
  • .htaccess mode: Writes Require not ip / Deny from rules between markers to .htaccess

Requirements

  • For country blocking, your CDN/host must set a country header (e.g., Cloudflare CF-IPCountry)
  • For .htaccess mode, your site must be on Apache with mod_authz_core (or legacy directives)

Installation

  1. Copy the wp-ip-blocker folder into wp-content/plugins/
  2. Activate “WP IP Blocker” in WordPress → Plugins
  3. Go to Settings → IP Blocker to configure

Settings

  • Enable Blocking: Master switch
  • Mode: PHP (IP + country) or Apache .htaccess (IP only)
  • Blocked IPs/CIDRs: One per line, supports IPv4/IPv6 and CIDR
  • Blocked Countries: Select multiple. You can also add extra ISO codes manually
  • Bypass Logged-in Admins: Avoids locking yourself out while testing

Uninstall

Running uninstall deletes plugin options and removes .htaccess rules created by this plugin.

Notes

  • This plugin avoids heavy DB queries and does not affect site performance under normal conditions
  • Works with proxies/CDNs by honoring X-Forwarded-For, X-Real-IP, and CF-Connecting-IP