Block Visitors by US State

Country rules stop one level too high

Ask a typical firewall or security plugin to block a state and it will offer you a country instead. That is the level almost every geo-blocking tool works at, because it is the level the underlying data was built for.

For plenty of sites the country is simply the wrong unit. A license covers a handful of states. A promotion runs in three of them. A product cannot legally cross one specific state line. Blocking the whole United States is far too blunt, and blocking nothing at all leaves the problem where it started.

IP Location Block treats the state as a rule target of its own. You list the states you care about, the plugin matches every incoming request against that list, and the decision happens before WordPress builds a page.

How state rules work in IP Location Block

Rules are plain text. You write one target per entry, and the same grammar covers every level of precision the plugin supports.

US
US:State:Texas
US:City:Los Angeles

The first line matches the whole United States. The second matches Texas and nothing else. The third narrows all the way to a single city. Region is an alias of State, so US:Region:Texas does exactly the same job as the example above. Any country code works the same way, which means the grammar carries over to provinces, prefectures, and other administrative areas outside the US.

Rules live in the Simple Blocking tab, where you decide whether the list you wrote is an allowlist or a blocklist. An allowlist admits only the places you named. A blocklist admits everyone except them. Most state-level setups want one or the other, rarely both.

Then you pick what a blocked visitor actually receives. IP Location Block can render a block page, redirect the request somewhere else, or return a bare response code. Full details are in the blocked response guide, and the rule grammar is documented under state and region rules.

The same rules can cover more than your public pages. IP Location Block applies per-target settings to wp-login.php, XML-RPC, and the admin area, so a state rule can guard the front end while a stricter country rule guards the login form.

Common questions about state blocking

Can I allow only certain states instead of blocking them?

Yes. The Simple Blocking tab treats your list as either an allowlist or a blocklist. Put US:State:Nevada and US:State:Michigan on an allowlist and every other request is refused, including the rest of the United States. That is usually the safer shape when the set of permitted places is short and known.

Does it work with page caching?

It depends on where the cache sits. IP Location Block runs inside WordPress, so a rule is evaluated whenever PHP handles the request. A full page cache that answers from disk or from a CDN edge can return a stored copy before PHP ever runs, and the rule never sees that visitor. The page cache guide covers the combinations that work and the ones that need an exclusion.

What about visitors on a VPN?

A VPN relocates the visitor. The request genuinely arrives from the exit server, so the geolocation for that address is correct even though the person is somewhere else. No IP-based tool can see through that, and any product claiming otherwise is overselling. Treat geo rules as a control that handles ordinary traffic well, not as proof of where somebody physically is.

How accurate is state-level data?

The native provider uses frequently updated geolocation data, which is what makes state rules usable at all. Accuracy still varies by network. Fixed residential and business connections resolve well. Mobile and satellite traffic is looser, because carriers aggregate traffic through regional infrastructure. Expect strong results across normal traffic and occasional misses near borders.

Can I use the same rules for other countries?

Yes. The grammar is not US specific. CA:State:Ontario or AU:State:Queensland follow the identical pattern, and plain country codes keep working alongside them. You can mix country-level and state-level entries in one list.