IP blocking, granular control over who reaches your site.
Block individual IPs, allow a trusted whitelist, or control access country-by-country. Guardian Gaze’s IP management lets you draw a perimeter around your site and decide exactly who’s invited inside. Whitelisted IPs bypass all other security restrictions; blocked traffic never reaches WordPress.
Availability: in the free plugin on WordPress.org: no account, no licence key · IP block lists and allow lists
The plugin view: findings, severity and next steps inside the WordPress admin
IP Blocking at a glance
Block list
Individual IPs that are denied access. Useful for blocking specific attackers, known malicious sources, and abusive bots. Blocked IPs receive a 403, no further requests reach WordPress.
Whitelist (allow list)
Trusted IPs that always have access, regardless of other restrictions. Useful for admins, your office network, monitoring services, your home IP. Whitelisted traffic bypasses every blocking rule.
Country (geolocation)
Either allow-list a small set of countries (everything else blocked) or block-list a set of countries (everything else allowed). Uses IP geolocation to detect visitor origin in real time.
Block lists, allow lists and country-level filtering
IP management decides who is allowed to reach your site at all, before WordPress does any work on their behalf. Block lists stop specific addresses and ranges. Allow lists guarantee access for addresses you control, which is what stops a security control from locking you out of your own site.
Country-level blocking works at a coarser grain, and for a lot of sites it is the setting that removes the most noise for the least effort. If your business ships only to the UK and Ireland, and login attempts arrive steadily from networks you will never sell to, blocking at that level cuts a large volume of traffic that had no chance of becoming a customer.
All of this is in the free plugin. It is not a licensed feature, and it is one of the few controls that reduces load as well as risk, since blocked traffic never reaches PHP.
A blunt instrument, used well
Country blocking will not stop a determined attacker. Proxies and residential VPNs are cheap and trivially available, and anyone specifically targeting your site will route around a country block in about a minute. Anybody selling it as a security boundary is overselling it.
What it does well is remove untargeted automated noise, and that is worth more than it sounds. When background traffic drops, the events that remain are worth reading, and an alert stream you actually read is the difference between security tooling that works and security tooling you have muted.
It also has a genuine cost. A customer travelling abroad hits the block, and so does a legitimate contractor working from somewhere you did not anticipate. Allow lists exist for exactly that, and the setting is worth reviewing rather than configuring once and forgetting.
Filtering is not a firewall, and Pro adds one
IP filtering decides whether an address may connect. It makes no judgement about what the request contains, which means a request from an address you have not blocked passes through untouched no matter what it is trying to do.
That is the gap the WAF fills on Pro: filtering at the HTTP layer based on the content of the request rather than its origin, which is the only place some attacks can be intercepted at all. An exploit against a vulnerable plugin has already succeeded by the time PHP is running it.
Pro also adds the IP reputation feed, which brings in networks with a current history of attack traffic rather than relying only on lists you maintain by hand.
IP Blocking - common questions
Is IP blocking free?
Yes, including country-level blocking. Block lists and allow lists are core plugin features with no licence required.
Does country blocking actually help?
It removes a large volume of untargeted automated traffic, which makes the remaining events readable. It will not stop a targeted attacker using a proxy, and it should not be relied on as though it will.
Will I block real customers?
Possibly, if they travel or use a VPN. Allow lists cover known exceptions, and the setting is worth reviewing periodically rather than configuring once.
What is the difference between this and the firewall?
IP filtering judges where a request came from. The firewall, on Pro, judges what the request contains, which is what catches an exploit arriving from an address you had no reason to block.
Can I block an entire range?
Yes, ranges as well as individual addresses, along with country-level rules.
Works with
IP Management →
Whitelists, blocklists and country rules.
Login Security →
Brute force stops at the door.
Security Hardening →
Fifteen toggles, applied in one click.
See it on your own site
The free scan takes under five minutes and tells you the truth.