WordPress Geo Redirect Plugin: IPGeolocation.io Geo Redirects & Content Control

1. Redirect visitors to a country store on another domain

Create a country redirect rule with Country code set to GR, CY , Apply to set to Entire site, Redirect URL set to your local store, for example https://gr.example.com/ , Redirect type set to 302 and Redirect method set to Automatic. Keep how often visitors are redirected on every visit, so returning visitors land on their local store each time. Then add a "Visit our international store" link on the local store that points to your main site with ?geo_bypass=1, so visitors can choose to stay.

2. Send shoppers to a regional page on the same site

Set Country code to CA , Apply to to Entire site and Redirect URL to a path such as /ca/ . The destination page itself is never redirected, so there is no loop, and WooCommerce cart, checkout and account pages are never redirected, so nobody is bounced mid-purchase.

3. Ask visitors before redirecting them

Set Redirect method to Popup when a visitor might reasonably want to stay, such as a currency or storefront switch. The redirect popup remembers the visitor's answer for 30 days.

4. Stop brute force login attempts

Under question 2, choose Only the addresses I list and enter your office or home IP address. Password guessing bots never reach the login form, and your public pages stay open to everyone. If your IP address changes often, use Anyone except the addresses I list and block the offenders instead.

5. Block a scraper or a spam source

Under question 1, choose Anyone except the addresses I list and paste the offending IP address or range, one per line. Blocked requests stop before any location lookup, so a hostile crawler costs you nothing in API credits.

6. Keep a staging or unfinished site private

Under question 1, choose Only the addresses I list and add your team's IP addresses. Everyone else lands on the page you nominate, or gets a 403.

7. Restrict a product or service by country

Use country access control in Block mode, list the country codes, and point the redirect URL at a page that explains why, on your site or on another one. This is the usual choice for licensing and regulatory restrictions, because it covers the whole site in one rule. On a cached site, make sure you keep country and IP blocking effective on cached pages.

8. Show a shipping notice only where it applies

Drop [ipgeo_if country_code="US"]Free shipping across the US.[/ipgeo_if] into a header or widget. There is no redirect and no duplicate page, so search engines still crawl one version of your content. See geo-targeted content with shortcodes.

1. Redirect rule settings

Rules are checked from top to bottom, and the first rule that matches the visitor's country and page wins, so put rules for specific pages above rules for the entire site. Page addresses match whatever their case and with or without a trailing slash, and pages with non-English addresses, such as Greek or Cyrillic slugs, match too. The visitor's query string, for example ?utm_source=newsletter , is passed on to the destination.

2. How often visitors are redirected

Above the redirect rules, choose how often the same visitor is redirected:

Each rule can override the site-wide choice with its own How often setting, for example every visit for your local store and once per day for a promotion page. Rules do not affect each other: a visitor sent on by a once per day rule is still redirected by an every visit rule elsewhere on your site.

New installs start with every visit. Sites that update from an earlier version keep once per hour until they choose otherwise, so an automatic update never changes who gets redirected. A change takes effect immediately, including for visitors who were redirected before it. For popups, the setting counts from when the visitor answers "Yes".

3. Popup confirmation

A popup asks before redirecting. You can edit the message, both button labels, and the text and background colors, with a live preview beside the fields. Use {{country}} in the message to insert the visitor's country code.

Expand

The popup remembers the visitor's answer for 30 days:

If you change the destination of a rule, its visitors are asked again. The popup is an accessible dialog: keyboard focus starts on the first button and stays inside the popup, and Escape closes it.

Use a popup when a visitor might reasonably want to decline, such as a currency or storefront switch. Use automatic for country specific pages where staying makes no sense.

4. Let visitors choose to stay on your site

Add ?geo_bypass=1 to any link to your site, and visitors who follow it are not redirected for 30 days. The usual place is a "Visit our international store" link on your local store. Answering "No" to a popup has the same effect.

To forget everything the plugin remembers about a visitor, including earlier redirects, popup answers and choices to stay, add ?geo_reset=1 to the address. Both parameters are removed from the address bar once they have been read, so they never end up in shared links.

5. Redirect loop protection between your sites

When a rule sends a visitor to another site, the plugin adds ?ipgeo_from=1 to the address, for example https://gr.example.com/?ipgeo_from=1 . If that site also runs this plugin, the marker stops it from sending the visitor straight back, and the visitor stays there for the rest of their browser session. The plugin on the receiving site then removes the marker from the address bar, even when that site has no redirect rules of its own.

If the other site does not run this plugin, the marker has no use there and nothing can remove it. Untick Add ?ipgeo_from=1 when sending visitors to another site above the redirect rules to keep its addresses clean. Keep it ticked when both sites run the plugin, because without it two sites with conflicting rules can send a visitor back and forth until the browser gives up.

Redirects to a page on your own site never carry the marker.

6. Pages that are never redirected

Some requests are never redirected, whatever the rules say:

• Logged-in users, and IP addresses on the safe list
• Search engine crawlers such as Googlebot and Bingbot
• WooCommerce cart, checkout and account pages, and every page below them
• Form submissions, RSS feeds, robots.txt , the REST API and AJAX requests
• Page previews and the Customizer
• The destination page of the rule itself
• Pages listed under page exclusions

1. Search engine crawlers and link previews

Blocking a country does not stop search engines from indexing your site. A crawler is let through only after a reverse DNS check confirms it really belongs to the search engine it claims, so a browser that pretends to be Googlebot is blocked like anyone else. The check covers Googlebot, Bingbot, Yahoo, Baidu, Yandex, Applebot, and the Facebook and X link preview crawlers, and each result is remembered for a day. DuckDuckBot cannot be verified this way, so it is treated as an ordinary visitor.

If a crawler or link preview service you rely on is still blocked, add its IP ranges to the safe list.

1. Your IP address

The top of the section shows the IP address your server currently sees for you, with a button that adds it to your safe list. If that IP address is not yours, your site is behind a proxy or CDN. Fix that under advanced settings before writing any rules.

2. Safe list

IP addresses listed here are never blocked, whatever the rules below say. They skip your country rules too. Add your own IP address first.

3. The two questions

1. Who can visit your website? Covers your public pages.

2. Who can reach your login page? Covers wp-login.php and the WordPress dashboard. This is separate from question 1, so you can lock the login page while your site stays open to visitors.

Each question has the same three answers:

An empty list blocks nobody, in either mode. That stops a half-finished allow list from taking your site down.

Locking the login page to your office IP address is the strongest option here. Password guessing bots never reach the form, and ordinary visitors are unaffected.

4. IP address formats

Every IP address box accepts one entry per line, in any of these formats:

Lines that cannot be read are skipped and reported back to you when you save.

5. What a blocked visitor sees

Set Send blocked people to this page to a path on your site, for example /access-denied , or to a full address on another site. Leave it empty and they get a plain 403 page instead. The page you choose always stays reachable, so there is no redirect loop.

Requests to the REST API, admin-ajax.php and xmlrpc.php always receive a 403 status rather than a redirect, so scripts get a clear answer.

6. Lockout protection

The plugin refuses to save a login rule that would block your own IP address, and tells you what that IP address is so you can add it and save again. To save the rule anyway, tick the confirmation box.

If you do get locked out, add this line to wp-config.php , log in, fix the rule, then remove the line:

define( 'IPGEO_DISABLE_IP_ACCESS', true );

7. Advanced settings

How your visitor's IP address is read

Automatic suits most sites. The other options are direct (no proxy), Cloudflare, and a custom proxy whose ranges you supply. Only change this if the detected IP address is wrong, and check it again after saving.

Cloudflare headers are trusted only when the request genuinely came from a Cloudflare server. The plugin refreshes Cloudflare's IP address ranges once a day and falls back to a bundled copy if that request fails.

Should logged-in users be blocked?

Choose from: never block administrators (default, and your safety net), never block anyone who is logged in, or block by IP address regardless.

Also apply the login rule to

Two optional extras. Leave admin-ajax.php off unless you are sure, because many contact forms and shop features use it. The plugin's own requests from cached pages are never blocked by the login rule. xmlrpc.php is safe to turn on unless you use the WordPress mobile app or Jetpack.

If an IP address cannot be read at all, block the request

Off by default, so an unusual request is let through rather than turning a real visitor away.

1. How cached page support works

With Cached page support turned on, which is the default, every page carries a small script. On a cached page it asks your site what to do for this visitor, then redirects them, shows the popup, or does nothing. The answer is remembered, so a visitor that no rule applies to is not checked again on every page. Visitors on uncached pages are still redirected instantly by the server. Popups and country specific content are never stored in the cache, so one visitor's popup is never shown to another.

2. Hide cached pages until the location is checked

Optional. It keeps the page hidden while the script checks the visitor's location, so visitors who are about to be redirected do not glimpse your site first. Only the first page of a visit is affected, and never for longer than the time you set, from 200 to 3000 milliseconds (1000 by default).

3. Keep country and IP blocking effective on cached sites

A blocked visitor who is served a cached copy of a page is not blocked. While country or IP blocking rules are active, this setting stops public pages from being cached, so there is never a copy to serve. It is on by default. Turn it off only if you enforce blocking at your CDN instead, for example with a Cloudflare WAF rule.

Sites that already had blocking rules when they updated to version 1.3.0 keep their caching as it was, and see a notice with a one-click button to turn the protection on.

4. Clear the page cache when settings change

When you save the settings, the plugin clears the cache of the supported cache plugins, so pages cached before the change do not keep the old behavior. Clear any CDN cache yourself.

5. Script optimization plugins

The cached page script is marked so that optimization features leave it alone, including WP Rocket's delayed JavaScript, Cloudflare Rocket Loader, LiteSpeed Cache, Jetpack Boost and WP Meteor. If you use another optimization plugin, exclude ipgeo-gate.js from its delay, defer and combine settings.

6. Location lookups and API credits

• Each visitor's location is looked up once and cached for 24 hours per IP address.
• Private and local IP addresses are never sent to the API.
• A failed lookup is retried after five minutes, so an outage is never stored as a real result.
• If the API key is invalid or your limit is reached, lookups pause for five minutes instead of failing on every page view, and the API status shows the error.
• IP rules are a local check and use no credits.