WooCommerce Geo-Blocking by State or Country

WooCommerce stops the sale, not the visit

WooCommerce is good at shipping rules. You choose the countries you sell to, restrict zones, and the cart refuses an address it cannot serve. For many stores that is enough.

It is not enough for stores that sell regulated products. CBD and hemp, alcohol, tobacco and vape, firearms accessories, supplements, and licensed goods all run into limits that are drawn at the state line rather than the border. WooCommerce restricts shipping countries at checkout. Its zone rules can go finer, but the check still happens at the end of the funnel, and only after an address is typed in.

So a visitor from a restricted state browses the catalog, reads product pages, adds to cart, works through checkout, and only then hits a wall. That is a bad experience, wasted ad spend, and a support ticket. Worse, that traffic was fully served right up to the last screen.

IP Location Block moves the decision to the front of the request. If a visitor is in a state or country you do not sell to, the rule fires before WordPress renders the page.

How it works on a store

Rules go in the Simple Blocking tab as plain text, one target per entry.

US:State:Idaho
US:State:South Dakota
US:City:Los Angeles

Set the list to block and those places are refused while everyone else shops normally. Set it to allow and only the places you named get through, which suits a store serving a small set of markets. Region is an alias of State, and a plain code such as US or FR restricts a whole country in the same list.

Front-end targeting decides how much of the site the rule covers. You can apply it across the whole public site, or scope it so the catalog and checkout are protected while your blog and landing pages stay open to everyone. The options are documented under front-end targets.

Then choose the blocked response. A block page can carry your branding and explain that you do not ship to that state. A redirect can send the visitor to a waitlist or an information page instead of ending the visit. A response code is the quiet option. See the blocked response guide for the details.

What this does not do

Worth being clear about the boundary, because it shapes the deployment.

IP Location Block matches on the visitor IP location at the request level. It does not read carts, inspect line items, or modify WooCommerce checkout logic. It cannot restrict a single product while leaving the rest of the catalog open, and it does not look at the shipping address a customer types in. Someone in a permitted state can still enter a restricted shipping address, and only WooCommerce sees that.

So the two belong together. Keep WooCommerce shipping zones and address restrictions as the authority on where an order can actually go. Add IP Location Block in front so restricted regions do not spend a session in a funnel that was never going to end in a sale. One handles the order, the other handles the visit.

Common questions from store owners

Can I block only the store pages and leave the blog open?

Yes. Front-end targeting controls which parts of the public site a rule applies to, so you can protect the shop, product pages, cart, and checkout while your articles and landing pages stay reachable from everywhere. That keeps your content marketing working in markets you cannot sell to. The settings are described under front-end targets.

What happens with a page cache in front of the store?

Cart and checkout are normally excluded from caching already, so rules there behave as expected. Catalogue pages are usually cached, and a full page cache can answer from disk or from a CDN edge before PHP runs, so the rule never sees that request. The page cache guide explains which setups work as they are and which need an exclusion.

What about customers on a VPN?

A VPN relocates the visitor, so the request genuinely arrives from the exit server and the geolocation for that address is correct. No IP-based tool can see past it. Geo rules are there to handle ordinary traffic cleanly, and your checkout-side address rules are what catch the rest.

We sell regulated products. Is this enough?

That is not a question anyone outside your business can answer, and this page is not legal advice. Rules for CBD, alcohol, tobacco, and similar categories vary by state and change over time, and age verification, licensing, and carrier restrictions may all apply alongside location. Talk to your counsel about what your obligations are, then use IP Location Block to enforce whatever map they hand you.