內容簡介
Country Access Control by CodeCaste 外掛提供了一個本地化的解決方案，讓使用者能夠根據國家來允許或阻擋訪客，而不需要依賴外部 API，從而提高網站的性能和隱私保護。
【主要功能】
• 允許或阻擋國家的模式，並提供可搜尋的國家選擇器
• 本地 IPv4 和 IPv6 IP 到國家的查詢
• 使用 MySQL/MariaDB 存儲，無需 PHP SQLite3 擴展
• 管理員繞過功能，避免鎖定自己
• 自動繞過 wp-admin、wp-login.php 和 REST API
• 驗證 Googlebot 繞過，使用反向 DNS 和前向確認
外掛標籤
開發者團隊
② 後台搜尋「Country Access Control by CodeCaste」→ 直接安裝（推薦）
原文外掛簡介
The issue we kept running into
On client sites, “block visitors from these countries” sounds simple — until you look at how most tools do it. Many geolocation plugins phone home on every request, or they lean on a third-party lookup API. That means extra latency, another service in the critical path, and a privacy story that is harder to explain to a client.
We also saw the other failure mode: the rule looks correct in settings, but a full-page cache (LiteSpeed, WP Rocket, Cloudflare HTML cache, host caching) keeps serving a previously allowed page to someone who should be blocked — or the reverse.
What we think about it
Country access control has to be local-first. The decision for a visitor should happen on your server, against data you control, without a round trip to an external API on every page view.
And because the response depends on who is visiting, page caching cannot treat every visitor as if they got the same HTML. If your cache layer ignores that, geo rules will look broken even when the plugin logic is fine.
Why we built this
Country Access Control (the product we also call Geo Lockdown) is our answer for WordPress shops that need country allow/block rules without shipping visitor IPs to a lookup API at runtime.
Lookups run against IP range data stored in your site’s MySQL/MariaDB tables. You choose when to refresh that data. Admin, login, and common WordPress endpoints stay reachable so you do not lock yourself out while testing.
What you get
Allow-list or block-list country modes with a searchable country selector
Local IPv4 and IPv6 IP-to-country lookups (no external API call while enforcing)
MySQL/MariaDB storage — no PHP SQLite3 extension required
Administrator bypass to help prevent lockouts
Automatic bypass for wp-admin, wp-login.php, REST API, AJAX, WP-Cron, and XML-RPC
Verified Googlebot bypass using reverse DNS and forward confirmation (User-Agent alone never bypasses)
Configurable trusted proxy / CDN headers, with Cloudflare connecting-IP validation against official Cloudflare ranges
Custom blocked message (403) or redirect to a URL you choose
Optional blocked-request logging
IP lookup cache with configurable TTL, plus a one-click Clear Lookup Cache action
Diagnostics panel and a Test IP tool so you can see what the plugin decides before you go live
Optional one-click download of the free DB-IP Country Lite dataset, imported through staging tables and an atomic swap
How to use it
Install and activate the plugin.
Go to Settings → Country Access Control.
Open the Diagnostics panel and confirm the detected IP looks right (especially if you use Cloudflare or another proxy).
Click Download Latest Database so you are not relying on the limited starter dataset in production.
Choose Allow or Block mode, select the countries, set the blocked response, then enable Country Access Control.
Save settings, then purge your site/page cache (see below) and test from a real visitor perspective — private/incognito while logged out is the easiest check.
Things to take care of (please read this)
1. Download a full GeoIP database before you trust the results
The plugin ships with a small starter dataset so it activates cleanly. That is enough to explore settings — not enough for production accuracy. Use Download Latest Database under the GeoIP Database panel. Nothing about your site or visitors is sent; only the public CSV file is fetched when an administrator clicks the button.
2. Page caching and CDNs
When Country Access Control is enabled, the plugin marks front-end responses as non-cacheable for common cache plugins (including LiteSpeed Cache, WP Rocket, and WP Super Cache style APIs) and purges those caches when you save settings.
That still does not cover every stack. If your host, CDN, or another plugin caches full HTML at the edge, you can get stale allow/block decisions until that cache is cleared or told not to cache HTML for the public site.
After you enable the plugin or change countries / response settings:
Purge the page cache in LiteSpeed, WP Rocket, W3 Total Cache, WP Super Cache, SiteGround Optimizer, or whatever you use
If Cloudflare (or another CDN) caches HTML, purge that cache too — or exclude the public HTML pages from cache while geo rules are active
Use Clear Lookup Cache in the plugin sidebar if you just updated the GeoIP database and want fresh lookups immediately
If rules still look wrong after a purge, open Diagnostics, run a Test IP, and confirm the detected IP / country before digging into theme or security-plugin conflicts.
3. Proxies, Cloudflare, and real visitor IPs
If the site sits behind Cloudflare or another reverse proxy, enable Cloudflare support and/or configure trusted proxies and the correct connecting-IP header. Otherwise the plugin may see the proxy IP instead of the visitor, and country decisions will be wrong.
4. Do not test blocks while logged in as an administrator
Administrator bypass is on by default (and wp-admin / wp-login are always bypassed). Turn administrator bypass off only while testing, and use a private window while logged out.
5. Honest limitation
This is IP-to-country mapping, not a GPS check. VPNs, proxies, Tor, and similar tools can present an IP from another country. No IP-only system can guarantee a person’s physical location.
External services
This plugin can optionally connect to one external service, DB-IP (db-ip.com), solely to let you download an updated GeoIP dataset.
What it is and what it’s used for: DB-IP publishes a free, monthly-updated “IP to Country Lite” CSV database under a Creative Commons Attribution 4.0 license. When you click Download Latest Database under Settings → Country Access Control, the plugin fetches that public CSV.GZ file directly from https://download.db-ip.com/ and imports it into your site’s own database. Country lookups for your visitors always run locally afterward — DB-IP is never contacted while your site is actually enforcing geo-restrictions, only when an administrator explicitly requests a database update.
What data is sent: Nothing about your site, its visitors, or their IP addresses is sent to DB-IP. The request is a plain HTTP GET for a public, static file; no query parameters, cookies, or identifying data are included.
When it’s used: Only when an administrator manually clicks “Download Latest Database.” It never runs automatically, on a schedule, or in the background.
Service links: db-ip.com · Free Lite database & license terms
