Geo-Blocking for Gambling and iGaming Sites

The rules change at every state line

Online gambling in the United States is regulated state by state. Sports betting, online casino, poker, and sweepstakes each sit in a different place in a different state, and the answer changes again outside the country. An operator is licensed in specific markets. An affiliate promotes offers that are only valid in some of them. A sweepstakes site runs on rules that a few states do not accept at all.

The consequence is the same in every case. Access has to be shaped by geography that is finer than a country, which is exactly the level most tooling refuses to work at.

IP Location Block matches requests down to state and region, so the map your site enforces can match the map your license describes.

How state-level enforcement works

Rules are plain text, one entry per target, written in the Simple Blocking tab.

US:State:New Jersey
US:State:Pennsylvania
US:State:Michigan

Set that list as an allowlist and only those three states reach the site. Every other request, in the United States and everywhere else, is refused by default. That shape suits a licensed operator, because the permitted set is short and changes only when a license does. A blocklist inverts it and suits sites that are broadly open with a few named exclusions. Region is an alias of State, and plain country codes such as CA or DE can sit in the same list for markets you handle at the national level.

Next you decide what a refused request receives. IP Location Block can render a block page explaining that the site is unavailable in that location, redirect to a landing page, or return a bare response code. A block page tends to work best here, because a clear message beats a site that looks broken. The options are covered in the blocked response guide.

Every evaluated request lands in the validation logs, so you keep a record of what was matched, what was refused, and when. That log doubles as an audit trail and as the way you sanity check a new rule before it meets production traffic.

The same rules extend past the public pages. Per-target settings cover wp-login.php, XML-RPC, and the admin area, which is worth setting up separately. A back office rarely needs the same map as the player-facing site.

Questions from operators and affiliates

Should I allowlist licensed states or block the unlicensed ones?

Allowlist, in most cases. A blocklist has to be complete to be correct, so every state you forget is open by default and every regulatory change is a race to update the list. An allowlist fails the other way. Anything you have not explicitly permitted is refused, which is the direction you want a compliance control to fail in.

Does the plugin give me an audit trail?

It keeps validation logs of the requests it evaluated, along with what happened to them. That gives you a technical record of enforcement over time. Whether the record satisfies a particular regulator is a question for your compliance team. Confirm the retention and privacy handling fit your own policies before relying on it.

Does this stop a player who uses a VPN?

No, and be careful with anyone who says their product does. A VPN moves the visitor. The request really does arrive from the exit server, so the geolocation is accurate for that address even though the person is elsewhere. IP-based blocking handles ordinary traffic well and cannot see through deliberate relocation. Operators who need more typically layer identity checks and payment-side controls on top.

Can I handle non-US markets in the same setup?

Yes. Country codes and state entries share one list, so US:State:Michigan can sit next to CA or a block on a country you do not serve. Provinces and regions elsewhere use the same grammar, for example CA:State:Ontario.