{"id":616,"date":"2026-07-07T11:01:38","date_gmt":"2026-07-01T03:29:29","guid":{"rendered":"https:\/\/brutefort.com\/blog\/wordpress-geo-blocking-login\/"},"modified":"2026-09-03T09:04:19","modified_gmt":"2026-09-03T09:04:19","slug":"wordpress-geo-blocking-login","status":"publish","type":"post","link":"https:\/\/brutefort.com\/blog\/wordpress-geo-blocking-login\/","title":{"rendered":"How to Restrict WordPress Login Access by Country"},"content":{"rendered":"\n
\"World
Photo by Pixabay from Pexels<\/figcaption><\/figure>\n\n\n\n

Checking your login logs and seeing hundreds of attempts from countries none of your users are ever in? That’s normal, and it’s also fixable in a couple of clicks. A large share of WordPress login attack traffic \u2014 brute force attempts, credential stuffing, automated bot scans \u2014 comes from a small handful of countries.<\/p>\n\n\n\n

Geo blocking restricts access to your login page based on the visitor’s country, as determined by their IP. It’s not a replacement for rate limiting or a custom login URL \u2014 it’s an extra layer that filters out a large chunk of attack traffic before it ever reaches the login form.<\/p>\n\n\n\n

Quick Answer:<\/strong> Go to BruteFort \u2192 Settings \u2192 Geo Blocking<\/strong>, toggle it on, choose Blacklist or Whitelist mode, select your countries, and save. Whitelist mode gives the tightest protection if your users are all in a few known countries.<\/p>\n\n\n\n

Blacklist Mode vs. Whitelist Mode<\/h2>\n\n\n\n

BruteFort’s Geo Blocking feature offers two modes. Which one you pick depends on where your users actually are.<\/p>\n\n\n\n

Blacklist mode<\/strong> blocks selected countries and allows everyone else. Choose this if your user base is global and you only want to cut off specific high-risk regions. Select the countries to block and save \u2014 anyone from those countries is denied access to the login page, while the rest of the world can still reach it.<\/p>\n\n\n\n

Whitelist mode<\/strong> allows only selected countries and blocks everyone else. This is the stronger option for sites with a defined geographic audience \u2014 a local business, a region-specific membership site, or anywhere you know exactly which countries your admins and users are in. Select only those countries, and every other country is blocked by default.<\/p>\n\n\n\n

For most sites, whitelist mode is the tighter fit. If you can say “my admins are in the US and UK and my users are never from anywhere else,” whitelist mode eliminates login attack traffic from the entire rest of the world in one setting.<\/p>\n\n\n\n

How to Set Up Geo Blocking in BruteFort<\/h2>\n\n\n\n
  1. Go to BruteFort \u2192 Settings \u2192 Geo Blocking<\/strong><\/li>
  2. Toggle Enable Geo Blocking<\/strong> on<\/li>
  3. Select your Mode<\/strong> \u2014 Blacklist (block selected) or Whitelist (allow only selected)<\/li>
  4. Open the Select Countries<\/strong> dropdown and choose the countries to block or allow<\/li>
  5. Click Save<\/strong><\/li><\/ol>\n\n\n\n
    \"BruteFort<\/figure>\n\n\n\n

    The restriction is active right away. Visitors from blocked countries trying to reach your login page \u2014 whether at the default \/wp-login.php<\/code> or your custom login URL \u2014 are denied access.<\/p>\n\n\n\n

    \"WordPress<\/figure>\n\n\n\n
    \n