I still have access from blacklisted country.

Posted on May 11, 2021

Does this plugin work properly?

Absolutely, YES.

However, there are some reasons why users have such an impression.

1. Wordfence Live Traffic

Sometimes, a Wordfence Security user who found some accesses in its Live Traffic view would claim that:

Hey, this plugin seems to block nothing!

Wordfence Live Traffic

But please do not get ahead of yourself, there’s a proper order for everything!

Before WordPress runs, Wordfence ingeniously filters out malicious requests to your site by enabling auto_prepend_file directive to include PHP based Web Application Firewall. Then this plugin validates the rest of the requests that pass over Wordfence because those were not in WAF rules, especially you enables “Prevent Zero-day Exploit”.

2. Confused Country Code

Unfortunately, accuracy of country code depends on the geolocation databases. Actually, there is a case that a same IP address has different country code.

Different country code

Here are other examples:

Confused country code

Strange country code

In such a case, please consider to select more reliable databases.

Considering the execution order

Please consider to set "mu-plugins" (ip-location-block-mu.php) as Validation timing in Validation rule settings. It enables to capture the requests prior to other plugins.

Validation timing

Find more details at Validation timing.