Region Block Admin

COUNTRY-LEVEL WP-ADMIN ACCESS CONTROL

Keep your WordPress admin login off the internet’s radar — everywhere you don’t need it.

Region Block Admin restricts access to wp-admin and wp-login.php based on where a visitor is connecting from. Choose which countries can reach your login screen, and every other request is turned away before it ever sees a password field — a simple, effective layer against the constant background noise of automated login attempts from regions you’ll never actually log in from.

What it Does

  • Country-level blocking. Pick any combination of countries from a full list and block admin access from them in one click — or use “Select all but my region” to lock things down to just where you work from.
  • Runs entirely on your own server. Country lookups are served from a local database table, not a live API call on every request — so there’s nothing to rate-limit, nothing to go down, and no outside service watching your login traffic.
  • Stays current automatically. The underlying IP database can refresh itself every month with one click or on a schedule, so newly assigned IP ranges keep being classified correctly.
  • Never locks you out. Your own IP is automatically whitelisted the moment you save your settings, and if a lookup can’t determine a visitor’s country for any reason, that visitor is let through rather than blocked — the plugin fails safe, not locked.
  • Whitelist support. Add specific IPs or IP ranges — a static office connection, a VPN, a remote teammate — that always bypass the region block regardless of country.
  • Doesn’t touch anything but the login screens. REST API calls, AJAX requests, scheduled tasks, and command-line access are never affected — only interactive visits to the login and dashboard screens are checked.
  • Optional activity logging. Turn on logging to record blocked attempts, so you can see the traffic the plugin is quietly turning away.

Why it Matters

A large share of automated attacks against WordPress sites — credential stuffing, brute-force login attempts, vulnerability scans — originate from a small number of regions with no real connection to most site owners’ actual audience or team. Cutting that traffic off at the door reduces noise in your logs, lightens the load on your server, and shrinks the pool of attempts against your login form — without affecting real visitors browsing the rest of your site.

What it Isn’t

Region blocking is one layer, not a complete security strategy. It doesn’t replace strong, unique passwords, two-factor authentication, or keeping WordPress and its plugins up to date — and a determined attacker can still route around it with a VPN or proxy. Think of it as reducing the size of the target, not eliminating it.

How to Use Region Block Admin

From first visit to a fully configured region block in about five minutes.

1. Open the Settings Screen

In your WordPress dashboard, go to Settings → Region Block Admin. This page is where everything happens — importing the IP database, choosing which countries to block, and turning enforcement on.

At the top of the page you’ll see your own detected IP address and region. Keep an eye on this — it confirms the plugin can correctly identify where you’re connecting from before you block anyone else.

2. Import the IP Database

Before any blocking can happen, the plugin needs its local country database in place. Under Local IP Database:

  1. Leave the source URL field blank to auto-detect the current month’s file, or paste a specific database URL if you want to import a particular version.
  2. Click Download & Import Now.
  3. Wait for the confirmation message showing how many IP ranges were imported. This can take a minute or two — your site keeps working normally the whole time, and the existing database (if any) stays active until the new import finishes.

Once imported, you’ll see the row count, the import date, and which source file was used displayed on this page, so you always know how current your data is.

3. Choose which Countries to Block

Scroll to Blocked Countries and tick the boxes for any regions you want to restrict. To speed this up:

  • Select all but my region — blocks everywhere except the country you were detected in, ideal if you only ever log in from one place.
  • Select all / Clear all — quickly reset the list to build your own combination from scratch.

4. Set up your IP Whitelist

In the IP Whitelist field, add any individual IP addresses or IP ranges that should always be allowed through, regardless of country — a home or office connection, a VPN exit node, or a remote teammate’s address. One entry per line. Your own current IP is added here automatically every time you save, so you can’t lock yourself out by mistake.

5. Configure the Remaining Options

  • Block message — the text shown to a visitor who’s turned away, in case you want to customize the wording.
  • Logging — turn this on to record blocked attempts, useful if you want to see the traffic being filtered out.
  • Monthly auto-update — turn this on so the IP database refreshes itself automatically each month, instead of importing manually.
  • API fallback — an optional extra check for the rare visitor the local database can’t classify. Leave this off unless you have a specific reason to enable it.

6. Turn it On

Once your country selections and whitelist look right, check Enable blocking at the top of the form and click Save Changes. From this point on, visits to your login screen from a blocked region will be turned away — while everything else on your site, and every other visitor, continues working exactly as before.

Tip: leave “Enable blocking” switched off while you’re still setting things up. Save your country and whitelist choices first, double-check your own IP and region are showing correctly at the top of the page, and only switch blocking on once you’re confident in the configuration.