=== IPGeolocation.io – Geo Redirects & Content Control === Contributors: ipgeolocation Tags: geolocation, geo redirect, ip blocking, country blocking, access control Requires at least: 5.8 Tested up to: 7.1 Requires PHP: 7.4 Stable tag: 1.2.0 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html Redirect visitors by country, block or allow visitors by IP address, and show different content to people in different countries. == Description == **IPGeolocation.io – Geo Redirects & Content Control** decides what each visitor sees based on where they are and what IP address they are using. You can send people from one country to a different page, keep unwanted IP addresses away from your site or your login page, and show or hide parts of a page depending on the visitor's location. Everything is set up from one settings screen, and you do not need to write any code. The plugin uses the **ipgeolocation.io API** to work out a visitor's country and other details. Results are stored for 24 hours per address, so your site stays fast. ### Main Features * Country-based redirects (entire site, specific pages, or URL patterns) * Optional popup confirmation before redirect * IP address blocking, with separate rules for your website and your login page * Address lists that accept single addresses, ranges, wildcards, IPv4 and IPv6 * Safe list of addresses that are never blocked by any rule * Protection against locking yourself out, with a recovery option * Country-level access control (allow or block) * Conditional content shortcodes * Output visitor geolocation data via shortcode * Page and query-string exclusions * Redirect bypass and reset via URL parameters * Bot detection (search engines and social crawlers excluded from redirects) * Administrator-safe (admins are never redirected) * IP response caching using WordPress transients ### Blocking Visitors By IP Address The IP section asks two questions, and you answer them separately: * Who can visit your website * Who can reach your login page For each one, you can leave it open to everyone, block a list of addresses, or allow only a list of addresses. Locking the login page to your office address is a simple way to stop password guessing bots, and ordinary visitors are not affected at all. IP rules are checked before any location lookup, so blocking somebody uses none of your API credits. == Installation == 1. Upload the plugin folder to `/wp-content/plugins/`. 2. Activate the plugin via **Plugins → Installed Plugins**. 3. Enter your **ipgeolocation.io API key** in the plugin settings. 4. Configure redirect rules, exclusions, country access rules, or IP rules. == Configuration == The plugin supports the following API plans from ipgeolocation.io: * Developer (Free) * Paid Additional security-related features are available for paid plans only. Blocking by IP address does not need an API key. Everything based on country does. == Shortcodes == ### Display Single Geolocation Field `[ipgeo country]` `[ipgeo city]` `[ipgeo country_code]` Available fields include: `ip, city, state, country, country_code, zipcode, continent, latitude, longitude, currency, calling_code, languages, is_proxy, is_tor, is_anonymous, cloud_provider` ### Conditional Content (Show If Match) `[ipgeo_if country_code="US,CA" logic="OR"]Visible to visitors from the US or Canada.[/ipgeo_if]` Supported attributes: country, country_code, state, city, continent, is_proxy, is_tor, is_cloud_provider, is_anonymous, logic (AND / OR) ### Conditional Content (Hide If Match) `[ipgeo_if_not country="Germany"]Hidden from visitors in Germany.[/ipgeo_if_not]` Both shortcodes accept the same attributes, so you can hide content from one country just as easily as showing it to another. == Redirect Bypass == For testing or user control, redirects can be bypassed: * `?geo_bypass=1` bypasses redirects for 30 days * `?geo_reset=1` resets the bypass cookie This does not affect IP rules. == Frequently Asked Questions == = Does this plugin redirect logged-in administrators? = No. Administrators are automatically excluded from redirects, and by default they are never blocked by IP rules either. You can change that in Advanced settings. = Are bots and search engines redirected? = Known bots (Google, Bing, Facebook, X and others) are excluded from country redirects. IP rules do not skip them, because any browser can claim to be a search engine. To exempt a crawler from an IP rule, add its addresses to your safe list. = Does the plugin cache API responses? = Yes. IP data is cached for 24 hours per IP. = Does it work with Cloudflare? = Yes. Choose the Cloudflare option under Advanced settings. The plugin only trusts Cloudflare's headers when the request genuinely came from a Cloudflare server, so nobody can pretend to be at a different address. = Will this slow down my site? = No. API results are cached, and IP rules are a simple local check with no lookup involved. = Do I need an API key to block IP addresses? = No. Blocking by IP address works without a key. Country features need one. = How do I find my own IP address? = The settings screen shows it at the top of the IP section, with a button that adds it to your safe list. = The plugin shows the wrong IP address for me. Why? = Your site is probably behind a CDN or proxy, which replaces the address your server sees. Open Advanced settings and choose the option that matches your setup, then check the address again after saving. = I locked myself out of my login page. How do I get back in? = Add this line to your wp-config.php file, log in, fix the rule, then remove the line: `define( 'IPGEO_DISABLE_IP_ACCESS', true );` The plugin normally refuses to save a rule that would lock you out, so this should be rare. = Does it work with a caching plugin? = Mostly. Logged-in visitors and uncached requests are handled normally. A page already saved as a cached file may still be served, because that happens before this plugin runs. Exclude any page that must always be checked. == External Services Used == This plugin connects to two outside services. **ipgeolocation.io** Used to find the country, region, city and security details for a visitor's IP address. This powers country redirects, country access control and the shortcodes. The visitor's IP address and your API key are sent to `https://api.ipgeolocation.io/v3/ipgeo` when a page needs location data. Results are stored for 24 hours per address, so a returning visitor does not cause a second request. Nothing is sent if you have not entered an API key, and nothing is sent for a visitor already blocked by an IP rule. An API key is required. You can get one by creating a free or paid account at [ipgeolocation.io](https://ipgeolocation.io/). Without it, the country-based features will not work. Terms of service: [https://ipgeolocation.io/tos.html](https://ipgeolocation.io/tos.html) Privacy policy: [https://ipgeolocation.io/privacy.html](https://ipgeolocation.io/privacy.html) **Cloudflare** Used only to keep an up-to-date list of Cloudflare server addresses. The plugin needs this list to tell whether a Cloudflare header can be trusted. Without it, that header could be faked by anyone. Once a day the plugin requests `https://www.cloudflare.com/ips-v4` and `https://www.cloudflare.com/ips-v6`. No visitor information, site information or personal data is sent. If the request fails, a copy included with the plugin is used instead. This only happens when address detection is set to Automatic or Cloudflare. Terms of service: [https://www.cloudflare.com/website-terms/](https://www.cloudflare.com/website-terms/) Privacy policy: [https://www.cloudflare.com/privacypolicy/](https://www.cloudflare.com/privacypolicy/) == Screenshots == 1. Country redirect rules settings 2. Redirect confirmation popup 3. Country access control settings 4. Conditional content shortcodes 5. IP access control, showing your own address and the two access questions == Changelog == = 1.2.0 = * Added IP access control: block or allow visitors by IP address, with separate rules for your website and your login page * Address lists accept single addresses, ranges such as 203.0.113.0/24, wildcards such as 192.0.2.*, and IPv6 * Added a safe list of addresses that are never blocked by any rule * The settings screen now shows your own IP address and how it was detected * The plugin refuses to save a login rule that would lock you out, with a wp-config.php recovery option * Security: visitor IP addresses can no longer be faked using request headers. If your site is behind a CDN or proxy, choose the matching option under Advanced settings * Fixed an empty redirect URL in Country Access Control causing an endless redirect loop * Fixed blocked visitors being redirected twice * Fixed cached location data not being reused within the same page load = 1.1.0 = * Upgraded internal API from v2 to v3 * Simplified plan types: Developer and Paid Plan only * Standard, Advanced, and Security plans auto-migrated to Paid Plan * Rename the plugin = 1.0.0 = * Initial public release * Country redirects with popup support * Country access allow/block rules * Conditional shortcodes * Bot detection and caching == Upgrade Notice == = 1.2.0 = Adds IP address blocking for your site and your login page, and fixes a security problem where a visitor could fake their location using request headers. If your site is behind a CDN or proxy, check the detected address on the settings screen after updating. = 1.1.0 = This update upgrades the internal API to v3. Existing plan types (Standard, Advanced, Security) will be automatically migrated to Paid Plan. No action required. = 1.0.0 = Initial release. == License == This plugin is licensed under the GPL v2 or later.