# Block visitors by country
Source: https://docs.webgee.com/en/security-ssl/how-do-i-block-particular-countries-from-visiting-my-websites





Block or allow visitors based on where they are. Applies to shared, reseller and
Premium hosting.

<Callout type="warn">
  Consider whether you need this. Country blocking is a blunt instrument: it
  blocks real customers, travellers and anyone using a VPN, while stopping
  determined attackers for about as long as it takes them to change exit node. If
  the goal is reducing bot traffic or brute-force attempts, a firewall rule or
  rate limit is more effective and has fewer side effects.
</Callout>

## The better option: Cloudflare [#the-better-option-cloudflare]

If your site is behind Cloudflare, block there rather than in `.htaccess`:

1. In Cloudflare, go to **Security → WAF → Tools**.
2. Add a rule matching **Country**.
3. Choose **Block** or **Managed Challenge**.

This is better in every practical respect. Blocked requests never reach your
server, so they consume none of your
[entry processes](/en/performance/entry-processes-ep-what-is-an-entry-process);
the country data is accurate and maintained; and you can change it instantly
without editing files.

**Managed Challenge** is usually the right action rather than **Block** — a real
person passes it, automated traffic does not.

See [Put your site behind Cloudflare](/en/domains-dns/how-do-i-enable-cloudflare-for-my-websites).

## Using .htaccess [#using-htaccess]

Where Cloudflare is not an option, block by IP range in `.htaccess`.

1. Use a service such as
   [Country IP Blocks](https://www.countryipblocks.net/) to generate the list.

2. Select the countries.

3. Choose the **Apache .htaccess Deny** format — or **Allow** if you are
   permitting a small set instead.

4. Generate and copy the result.

   <img alt="Generating an access control list by country" src="__img0" />

5. Paste it into `.htaccess` in your document root.

<Callout type="warn">
  These lists are **long** — often thousands of lines — and Apache evaluates them
  on every single request. A large list measurably slows your site, including for
  the visitors you are keeping. This is the main reason to prefer Cloudflare.

  The ranges also go out of date. A list generated today is wrong within months.
</Callout>

## Check it worked [#check-it-worked]

Use an online proxy or a VPN endpoint in a blocked country and confirm you get a
`403`.

Check your own access still works before closing the editor. Blocking your own
country by accident locks you out of your site — though not out of cPanel, so
the fix is to edit `.htaccess` back.

## Related [#related]

* [Unblock an IP address from the firewall](/en/security-ssl/how-do-i-unblock-or-whitelist-an-ip-address-from-the-firewall)
* [Put your site behind Cloudflare](/en/domains-dns/how-do-i-enable-cloudflare-for-my-websites)