SF GeoGuard

Description

SF GeoGuard is a lightweight country-based access control plugin for WordPress.

It allows you to restrict website access by visitor country using simple ISO country codes (US, CA, GB, etc.), helping reduce unwanted traffic, bot activity, and unnecessary server load.

Main features:
* Allow access only from selected countries
* Whitelist IP addresses
* Cache IP country lookups for better performance
* Customize the block message (HTML supported)
* Choose what happens if the geo service is unavailable (allow or block)
* Support for sites behind reverse proxies (Cloudflare, Nginx)

SF GeoGuard focuses on doing one thing well: restricting access by country.
It does not modify WordPress core files and does not load unnecessary scripts on the frontend.

By default, geo checks are applied only to frontend requests. You can optionally
enable restrictions for wp-admin and wp-login.php in the plugin settings.

External Services

This plugin connects to a third-party IP geolocation service to determine
the visitor’s country based on their IP address.

Service used:
IP-API (https://ip-api.com/)

Purpose:
The service is used to detect the visitor’s country in order to apply
country-based access rules configured in the plugin settings.

Data sent:
– Visitor IP address

When data is sent:
– On frontend page load when geo-based access control is enabled
– Only if the visitor IP address cannot be resolved from the local cache

Note:
The free IP-API endpoint does not support HTTPS. The plugin uses the HTTP
endpoint provided by IP-API unless a paid HTTPS plan is used.

Privacy & Terms:
– Privacy Policy: https://ip-api.com/docs/legal
– Terms of Service: https://ip-api.com/docs/legal

No personally identifiable information other than the IP address
is stored, logged, or shared by the plugin.

Installation

  1. Upload the plugin folder to /wp-content/plugins/ or install it via the Plugins menu.
  2. Activate SF GeoGuard.
  3. Go to Settings SF GeoGuard.
  4. Enable protection and set the allowed countries.

FAQ

Will this work with Cloudflare or other proxies?

Yes. If your site is behind a reverse proxy (Cloudflare, Nginx, etc.), configure
Trusted Proxies so the plugin can safely trust forwarded IP headers.

Can I lock myself out of wp-admin?

If you enable Apply to wp-admin and login, make sure your own country
is allowed or your IP address is whitelisted to avoid being locked out.

What happens if the geo service is unavailable?

You can choose what to do if the geo service fails: allow access (recommended)
or block access.

Reviews

6. Januar 2026
I was looking for a simple and lightweight way to block traffic from specific countries without installing a heavy security suite. SF GeoGuard does exactly what it promises: Easy country-based blocking Clean and understandable settings Works well behind proxies and Cloudflare No unnecessary features or bloat The plugin is fast, straightforward, and focuses on one task instead of trying to be an “all-in-one” security solution. Setup took only a few minutes, and it worked as expected right away. Great option if you want simple geo access control without performance overhead.
Read all 1 review

Contributors & Developers

“SF GeoGuard” is open source software. The following people have contributed to this plugin.

Contributors

Translate “SF GeoGuard” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

1.0.0

Initial release.