Find Us At

901, Shapath V, Sarkhej - Gandhinagar Hwy, opp. Karnavati Club Road, Prahlad Nagar, Ahmedabad, Gujarat 380015.

Call On

+91 79-48000011

Mail Us

info@codecaste.com

Find us here
WordPress Plugin

Country Access Control by CodeCaste

Control website access by visitor country using a local IP geolocation database, with safety bypasses, diagnostics, and controlled database updates.

  • Version 1.3.0
  • Price Free
  • License GPL
Read FAQs
Country Access Control by CodeCaste
Why it exists

Country-based access control without sending every lookup to a third-party API

Local-first country checks

Uses a local IP geolocation database for visitor country checks, so normal enforcement does not require a third-party lookup API call.

Built-in safety and bypasses

Administrator, WordPress endpoint, and verified Googlebot bypasses help keep legitimate access and site administration available.

Controlled database updates

Country database updates are administrator-controlled, with diagnostics and import tools available when you need to refresh the local data.

How it works in practice

Geo Lockdown lets WordPress site owners allow or block countries using IP range data stored in the site's MySQL/MariaDB database. Country lookups run locally on your server without external API calls during enforcement.

Key features

  • Allow-list or block-list country modes
  • Local IPv4 and IPv6 IP-to-country lookups
  • MySQL/MariaDB storage with no PHP SQLite3 requirement
  • Administrator bypass to help prevent lockouts
  • Automatic bypass for wp-admin, wp-login.php, REST API, AJAX, WP-Cron and XML-RPC
  • Verified Googlebot bypass using reverse DNS and forward confirmation
  • Configurable trusted proxy/CDN headers with Cloudflare range validation
  • Custom blocked-page message or redirect URL
  • Optional blocked-request logging
  • IP lookup cache with configurable TTL
  • Diagnostics panel and test IP tool
  • Optional one-click DB-IP Country Lite download or manual CSV/GZ import
  • Staged database imports with an atomic table swap

Important limitation

Country enforcement is based on the visitor's public IP as mapped by the local database. VPNs, proxies, Tor and similar services can present an IP from another country. No IP-only system can guarantee a person's physical location.

External service

The optional database-update feature connects to DB-IP only when an administrator explicitly requests a database download. Visitor lookups are performed locally after the database is imported.

Prefer to read the source before you install it on a client site? You can also find it on GitHub.

View on GitHub
Capabilities

What you get when you install it

Country allow/block modes

Choose whether selected countries are allowed or blocked from visiting the public site.

Local IP geolocation

IPv4 and IPv6 country lookups run against data stored in your WordPress database instead of calling an API for every visitor.

Safety and bypass controls

Keep wp-admin and wp-login accessible, bypass trusted administrators, and optionally allow verified Googlebot traffic.

Diagnostics and test tools

Inspect detected IP information, bypass reasons, lookup timing, and test an IP directly from the settings screen.

Controlled database updates

Download the free DB-IP Country Lite dataset on demand or import your own CSV/GZ database through staged tables and an atomic swap.

FAQs

Questions? We've got answers

Everything you need to know before installing country-based access controls on a WordPress site.

No. Country lookups are performed against the local MySQL/MariaDB database. The only documented external connection is the optional administrator-triggered DB-IP database download.

Yes. The plugin supports both allow-list and block-list modes with a searchable country selector.

wp-admin and wp-login.php are bypassed. Logged-in administrators can also bypass restrictions by default.

Yes. Trusted proxy/CDN headers can be configured, and Cloudflare source ranges are validated before those headers are trusted.

When enabled, Googlebot is verified using reverse DNS and forward confirmation. A User-Agent string alone is not trusted.

Use Download Latest Database to fetch the free DB-IP Country Lite CSV.GZ, or use Import CSV Database to upload a compatible database manually.

No. Geo Lockdown stores geolocation data in MySQL/MariaDB tables.

The restriction is based on a public IP-to-country mapping. VPNs, proxies, Tor and similar services can make the mapped country differ from the visitor's physical location.

Built here. Supported here.

If it breaks on a client site, we want to hear it.

This is not a ticket that lands in a void. Someone on this team wrote the scanner you just ran, and they still read what comes in.

Something broke?

Walk us through the last thing you did before it failed. We will look for the conflict with you, not send you a canned reply.

Need a change?

If you caught yourself wishing it did something else on a client call, tell us. Those notes from real shops shape the next version.

Found an issue, or not sure yet?

Ask before you run a cleanup on production. A five-minute question now is cheaper than rolling a live library back on Friday.

Contact Us

Let's Connect

Found a bug after a scan, need a change, or have feedback before this goes on a client site? Send it over. We read these ourselves.

Address

901, Shapath V, Sarkhej - Gandhinagar Hwy,
opp. Karnavati Club Road, Prahlad Nagar,
Ahmedabad, Gujarat 380015.

Send us a note







     

    We'll only use your details to reply. We never share them or add you to any list.

    From the workshop floor

    More tools we are building right now

    Grab what is ready, follow what is cooking, and tell us what you would use on your next client site.