HULO Geo-block
| 开发者 | huloglobal |
|---|---|
| 更新时间 | 2026年11月13日 17:39 |
| PHP版本: | 8.1 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
HULO Geo-block decides, before WordPress runs its main query, whether a visitor may use your site. Allowed visitors are untouched; refused visitors see a branded block page or are redirected.
Works on any WordPress site. If you take payments with the free HULO Payments plugin, payments from blocked visitors are refused before they are charged.
Rules
- Region presets: Worldwide, United Kingdom only, European Union, North America and Oceania.
- Extra allowed countries and always-blocked countries (for example "the EU except one country", or "worldwide except a few").
- A live, plain-English summary of what the rules do, and a warning before you save rules that would block everyone.
- Administrators are never blocked.
- wp-admin, the login page, cron, AJAX, the REST API, XML-RPC, payment-gateway callbacks (
wc-api), robots.txt and sitemaps are never blocked. - IP allowlist with IPv4 and IPv6 addresses and CIDR ranges, plus a one-click "Add my IP".
- Well-known search and link-preview crawlers (Googlebot, Bingbot, DuckDuckBot, Applebot, Facebook, LinkedIn, Slack, WhatsApp and more) are let through by default, so a country restriction does not drop your site out of search results. Permissive, custom and off modes are available.
- Crawlers may only browse. A User-Agent can be faked, so add-to-cart, checkout and payments are never exempt.
- Optional reverse-DNS verification of Googlebot and Bingbot: a visitor claiming to be one is checked against googlebot.com / search.msn.com before it is let through.
- Block pages send
noindex; closures (business hours, maintenance) send HTTP 503 with Retry-After so search engines treat them as temporary.
- A weekly opening window in any time zone, including overnight windows and daylight saving.
- A one-off maintenance window with its own allowed IPs.
- Cloudflare
CF-IPCountry(andcf-region-code), Akamai and Fastly country headers, once you tell the plugin the site is behind that CDN. Any visitor can send these headers, so they are honoured only for requests arriving from a trusted proxy: Cloudflare's published ranges (one tick) or the addresses you list (or theHULO_TRUSTED_PROXIESconstant). - Web-server GeoIP modules (
GEOIP_COUNTRY_CODE,MM_COUNTRY_CODE). - This plugin never calls a geolocation API. If no source is available yet, the settings page says so and visitors with an unknown country are allowed.
- A full country list ships with the plugin.
- Proxy-aware visitor IP: by default only the connecting address is used. Forwarding headers you tick are read only from trusted proxies, and for
X-Forwarded-Forthe right-most address that is not one of your proxies is taken.
- Only refused responses are changed, and they are sent with
no-storeandDONOTCACHEPAGE, so no page cache stores a block page. - Optional page-cache helper: if a full-page cache serves pages without running WordPress, a small script re-checks the visitor against an uncached endpoint.
GET /wp-json/hulo-geo-block/v1/checkreturns the current visitor's verdict (uncached). A server-side caller can pass the visitor's country signed with a secret.- The endpoint is rate-limited per visitor IP: 120 requests a minute by default, configurable on the Settings tab (requests and window, or off when a CDN or firewall already limits it). Over the limit it answers 429 with Retry-After.
- refuses add-to-cart, the classic checkout and the Checkout block (Store API) for blocked visitors, on the server, whatever a page cache served;
- never blocks shop managers;
- can use the shop's geolocation, including its MaxMind database integration, as a country source;
- uses the shop's translated country names.
安装:
- Install HULO Geo-block from Plugins → Add New, or upload the zip, and activate it.
- Go to HULO → Geo-block. If the page says no country source was found, put the site behind a CDN that sends the visitor's country (for example Cloudflare) and set it up on the Settings tab (country headers and trusted proxies), or enable a GeoIP module in your web server. On a WooCommerce shop you can instead add a MaxMind licence key in its Integration settings.
- On the Rules tab pick the regions or countries you serve, tick "Apply the country rules to visitors" and save.
屏幕截图:
常见问题:
Can I lock myself out?
No. Administrators are never blocked, wp-admin and the login page are never blocked, and the plugin will not switch on rules that would allow no one.
Do I need WooCommerce?
No. Geo-block works on any WordPress site. If you do run it, Geo-block also guards add-to-cart and checkout and can use the shop's MaxMind geolocation.
What happens when a visitor's country is unknown?
They are allowed; allowlists, business hours and maintenance still work. Set up a country source (see Installation, step 2) so countries are known.
Does it work with page caching?
Yes. Block pages are never cached. If your cache serves HTML without running WordPress, turn on the page-cache helper on the Settings tab. Checkout and payments always re-check the visitor on the server.
Will Google still index my site?
Yes, by default search and link-preview crawlers are let through.
Can a visitor fake their country or pretend to be Googlebot?
Country headers are only believed when the request comes from a proxy you trust, so a visitor cannot send their own. A crawler User-Agent only lets a visitor browse, never buy or pay, and with reverse-DNS verification on, a fake Googlebot or Bingbot is treated like any other visitor.
Does the plugin contact any external service?
No. See "External services" below.
更新日志:
0.1.2
- Configurable rate limit for the public check endpoint (requests per visitor IP and window length, 0 to switch it off) on the Settings tab, with a
hulo_geo_block_rate_limitfilter. The 429 answer's Retry-After now says when the window resets.
- Security: crawler User-Agents may browse but never buy or pay; CDN country and IP headers are honoured only from trusted proxies (off by default); REST,
wc-apiandwc-ajaxexemptions follow what WordPress actually routed; optional reverse-DNS verification of Googlebot and Bingbot. - The block page's styles are registered and printed through WordPress, and settings forms read and sanitise each declared field.
- First release for any WordPress site: country and region-preset rules, always-blocked countries, IP allowlist (IPv4/IPv6 CIDR), crawler allowlist, branded block page or redirect, business hours, maintenance window, CDN/web-server geolocation, bundled country list, page-cache helper, headless check endpoint and extension hooks.
- With HULO Payments: payments from blocked visitors are refused. With WooCommerce: add-to-cart and checkout guards (classic and Checkout block) and its MaxMind geolocation.