Geo-Block the Visitors to Your Online Applications

Back to All Posts

Online applications face many cyberattacks and exploits. Some online applications or some of their content are not available in some regions of the world. You can geo-restrict visitors from unavailable zones on your application using IP location services like the IPGeolocation.io API.

The steps to avoid unauthorized access in the restricted regions using IP location services would be:

If a user visits a page on your online application, get their approximate location from their IP address using the IPGeolocation.io API.
Check if the viewed page or content on it is in restricted zone(s).
Check if the user's location is in any restricted zone.
If the page contains content restricted in the user's location, remove the content from the page or display a blocked message.

Here is how you can do it using IPGeolocation.io API:

Before moving on to code, you need to get an API key to use IPGeolocation.io API. If you do not have an account at IPGeolocation.io, then:

Sign up here.
Then log in to the IPGeolocation.io Dashboard and get your API key listed under the subscribed API plan.

Geo-Block Your Visitors using IPGeolocation.io jQuery SDK

Open a text editor and open the page, with restricted access, of your website, say index.html.

Add the following script in the head tag of the page.

<script src="https://cdn.jsdelivr.net/npm/ip-geolocation-api-jquery-sdk@1.1.2/ipgeolocation.min.js"></script>

Add another script block at the bottom of the head tag of the page.

<script>
  // Enable sessionStorage usage to store API response on client-side. This avoids duplicate API calls for a visitor visiting multiple pages during a single visit.
  _ipgeolocation.enableSessionStorage(true);

  // Disable async calls to ipgeolocation.io API, so the check finishes before the rest of the page loads.
  _ipgeolocation.makeAsyncCallsToAPI(false);

  // Fetch only the `country_code2` field from the response excluding rest of the response as we'll restrict access based on the country.
  _ipgeolocation.setFields("country_code2");

  // Get IP-Location for the visitor's IP address. Replace "YOUR_API_KEY" with the API key from the ipgeolocation.io dashboard.
  _ipgeolocation.getGeolocation(redirectToUnauthorizedPage, "YOUR_API_KEY");

  function redirectToUnauthorizedPage(response) {
    // Allow visitors only from US or CA: leave them on the page they requested.
    if (response && ["US", "CA"].includes(response.country_code2)) return;

    // Send everyone else, including failed lookups, to the error page unless they're already on it.
    if (window.location.pathname !== "/unauthorized-access.html") {
      window.location.replace("https://site.com/unauthorized-access.html");
    }
  }
</script>

This browser example controls navigation only. Enforce access restrictions on the server or edge before sending protected content.

Geo-Blocking the Visitors using PHP

Open a text editor and open the page of your website with restricted access, say index.php.

Add the following code at the very top of index.php, before any HTML output. PHP can only send a redirect header before the page starts rendering.

<?php
  // query ipgeolocation.io API and returns JSON response
  function get_geolocation($apiKey, $ip, $lang = "en", $fields = "*") {
    $url = "https://api.ipgeolocation.io/ipgeo?apiKey=".$apiKey."&ip=".$ip."&lang=".$lang."&fields=".$fields;
    $cURL = curl_init();

    curl_setopt($cURL, CURLOPT_URL, $url);
    curl_setopt($cURL, CURLOPT_HTTPGET, true);
    curl_setopt($cURL, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($cURL, CURLOPT_HTTPHEADER, array (
      "Accept: application/json"
    ));

    return curl_exec($cURL);
  }

  // get ipgeolocation for the visitor's IP address. Replace YOUR_API_KEY with your API key.
  $json = get_geolocation("YOUR_API_KEY", $_SERVER["REMOTE_ADDR"], "en", "country_code2");
  $geolocation = json_decode($json, true);
  $currentWebsite = $_SERVER["SERVER_NAME"];
  $redirect = false;
  $redirectTo = null;

  // allow visitors only from US or CA, else redirect to security error message
  if ($geolocation["country_code2"] == "US" || $geolocation["country_code2"] == "CA") {
    $redirect = false;
  } else {
    $redirect = true;
    $redirectTo = "https://site.com/unauthorized-access";
  }

  if ($redirect) {
    header("Location: ".$redirectTo);
    die();
  }
?>