Comparison
Cloudflare Geo-Blocking, but State-Level
Cloudflare blocks by country at the edge. IP Location Block adds state and city rules, and applies them where WordPress can tell a login attempt from a page view.
What Cloudflare country blocking does well
Cloudflare WAF custom rules and IP Access Rules can match on the visitor country. The CF-IPCountry header carries a country code, and a rule can act on it before the request ever reaches your origin.
That is genuinely valuable. Traffic stopped at the edge costs you no PHP time, no database queries, and no bandwidth. One rule covers every application behind the proxy, not only WordPress. If your requirement is a list of countries that should never reach the site, Cloudflare handles it well, and you should keep it.
Where the country code runs out
A country code is a coarse unit, and the edge does not know what WordPress is.
Country is the only unit
Standard Cloudflare geo controls match a country code. Allow the United States but deny one state, or deny one city, is not a rule you can express there.
The edge is not WordPress aware
A rule at the edge sees a path and some headers. It does not know that one country should read your articles freely and never touch wp-admin.
The decision lives elsewhere
Requests stopped upstream leave no record in WordPress. To see what was blocked and why, you leave your site and open another dashboard.
What IP Location Block adds
Rules written in the units you actually think in, enforced per WordPress target.
State and city rules
With the native provider connected, a rule can read US:State:California or US:City:Los Angeles. Country rules such as US still work the same way.
One rule set per target
The front-end, wp-login.php, the admin area, and XML-RPC are configured separately. Lock down the login form worldwide while public pages stay open.
Your choice of response
Decide what a blocked visitor receives: a block page, a redirect, or a bare response code. The answer comes from your site, in your wording.
Validation logs in WordPress
Every decision is recorded where the site lives. Read the log, find the request that should not have been blocked, and adjust the rule that caught it.
Use both
This is not a replacement. The two layers do different jobs.
Keep Cloudflare for the edge
CDN, DDoS mitigation, TLS, and the broad country denials you never want to reach your origin. Volume that is stopped upstream costs you nothing.
Add the plugin for the rules
State and city precision, per target protection, allowlists for the endpoints your integrations depend on, and a log you can read without leaving WordPress.
If your site sits behind Cloudflare, every request arrives from a Cloudflare address. IP Location Block reads the real visitor IP from the proxy header you nominate in its settings. Set that before you trust any result, or your rules will match the proxy instead of the visitor.
Side by side
Where each layer is strong, stated plainly.
| Cloudflare geo controls | IP Location Block | |
|---|---|---|
| Where the rule runs | At the edge, before the request reaches your server. | Inside WordPress, on your server. |
| Country rules | Yes, matched on the country code. | Yes. A rule like US. |
| State or region rules | Not part of the standard geo blocking rules. | Yes, with the native provider. US:State:California. |
| City rules | Not part of the standard geo blocking rules. | Yes, with the native provider. US:City:Los Angeles. |
| Separate rule per WordPress target | No. The edge sees URLs and headers, not WordPress targets. | Yes. Front-end, login form, admin area, XML-RPC, and comments are configured separately. |
| What a blocked visitor gets | A Cloudflare block or challenge page. | Your choice of block page, redirect, or response code. |
| Record of the decision | In your Cloudflare dashboard. | In the WordPress validation logs, next to the rest of your site data. |
| Cost to start | Included with your Cloudflare plan. | Free plugin. Free plan of 10,000 requests a month for the native provider. |
Set it up in five steps
- Install the free plugin from WordPress.org and activate it. Leave your Cloudflare rules alone.
- Set the proxy header in the plugin settings so the real visitor IP is used, then confirm a known address resolves correctly.
- Create a free account, copy the API key, and follow connect a provider to select IP Location Block as the source.
- Choose the targets to protect and write your rules, including state and region rules. Getting started walks through the order.
- Watch the validation logs for a few days before you tighten anything, then pick the response a blocked visitor should receive.
Requirements are WordPress 6.5 or later and PHP 8.1 or later. The current release is 1.4.x.
Add state-level rules to your stack
Keep Cloudflare at the edge. Add the free plugin for the rules country codes cannot express, with 10,000 requests a month at no cost.