The IP Location Block plugin has never been short of ways to look up an IP address. It can talk to IPInfoDB, ipinfo.io, ipapi and ipstack, and it can read a local IP2Location or GeoLite2 database file straight off your server. All of those still work, and all of them answer the same question: which country is this address in?
We built our own provider anyway. The reasoning has not changed since we launched it, and it explains a few things about how the plugin behaves today, so it is worth writing down properly.
One provider, one schema
Every geolocation service has its own idea of what an answer looks like. The field names differ. The country code casing differs. What comes back for a private address, a reserved range, or an address nobody has assigned yet differs. So does what happens when the service is having a bad day: some return an error, some return an empty string, some return a country that is simply a guess.
A blocking plugin has to turn all of that into one decision: allow or deny. Every provider we did not write ourselves is a translation layer, and every translation layer is a place where an edge case turns into a visitor being blocked who should not have been, or let through when they should not have been. When the plugin talks to our own API, there is one response format to reason about and one set of rules for what an unknown address means.
Services change, and some of them go away
Over the years the plugin has carried a longer list of lookup services than it does today. Some of them retired their free tier. Some changed their response format. Some shut down entirely, which for a site owner means a blocking rule that quietly stops matching until somebody notices.
None of that is a complaint about the services themselves. They are free or cheap products, and free or cheap products get discontinued. It is a bad foundation for a security feature, though. When geolocation is the thing standing between your login page and a botnet, the thing that answers the lookup should be something we can fix ourselves, on the same day, without waiting for somebody else’s roadmap.
Fresh data with nothing to download
The local database option, IP2Location or GeoLite2 as a file on your server, avoids the network call. The tradeoff is that the file is a snapshot. Address ranges get reassigned constantly, so a snapshot starts drifting the moment it lands on disk, and keeping it current means a scheduled download, disk space for the database, write permissions on the directory, and something to notice when the download fails.
Every WordPress host has a slightly different opinion about at least one of those. Our API removes the whole category: there is no file, no cron job, and no update step. The plugin asks a question over HTTPS and gets an answer from data we maintain on our side.
Country is not always enough
This is the part that most directly affects what you can do in the plugin. Every provider listed at the top of this post answers at country level, and for a lot of sites that is the right granularity. But plenty of the requests we get are narrower than a country. A regional business does not serve customers outside two or three states. A local practice takes bookings from one metro area. A store ships to a country but not to a specific territory within it.
You cannot express any of that with a country code. State, region and city rules in the plugin exist because our own provider returns the data they need, and they work only when the plugin is pointed at it. If you are using one of the other options, a state or city rule falls back to the country it names, and that is by design rather than a bug. There is a walkthrough of how those rules work in the state and region documentation.
Getting started
The free plan covers 10,000 requests per month, which is more than enough for a small site to run country and state rules without paying anything. You can create an account, generate a key, and paste it into the plugin. The current steps, including where the key lives in the dashboard and which setting it goes into on the WordPress side, are in the connect a provider guide.
If your site does enough traffic to go past the free tier, the paid plans are listed on the pricing page. And if you are happy with country level blocking against a service you already have a key for, keep using it. The other providers remain in the plugin and we have no interest in taking your choices away. We just wanted the default path to be one we could stand behind.