“We only sell in Australia. Can’t we just block every other country?”
It’s a fair question, and the honest answer is: you can, it helps a bit, and it’s easy to do badly. We do block some countries on our own site. Here’s how to think about it.
What geo-blocking is good for
Blocking or challenging countries you never do business with cuts the noise. A lot of automated junk (login attempts, form spam, vulnerability scanners) comes from a fairly small set of networks and places. Turning that away at Cloudflare means less load on your server, fewer spam emails, and cleaner logs, so the real problems are easier to spot.
It’s cheap, too. On Cloudflare you can do it with a single custom rule on any plan:
(ip.src.country in {"XA" "XB" "XC"})(Swap in the real two-letter country codes you want.) Note that the older IP Access rules tool only lets you block by country on Enterprise. On other plans, use a custom rule like the one above. Cloudflare recommends custom rules for this anyway.
What it’s not good for
It doesn’t stop a determined attacker. A VPN or a cloud server in Sydney costs a few dollars a month. Anyone targeting you specifically will simply come from an allowed country. Geo-blocking filters out the lazy, automated stuff, not the people you’d most worry about.
Country data isn’t perfect. IP geolocation is usually right about the country, but not always. Mobile networks, satellite internet and corporate networks sometimes appear to be somewhere else.
What it can break
This is where most geo-blocking goes wrong. Before you block a country, think about:
- Your customers when they travel. An Australian customer on holiday in Bali or London still wants to pay their invoice.
- Your own staff and contractors overseas, including that offshore developer or bookkeeper.
- Search engines. Google and Bing crawl mostly from the United States. Block the US and you’ll quietly drop out of search results. (A Skip rule for verified bots above your country rule avoids this.)
- Payment providers, webhooks and integrations. Your payment gateway, booking system or accounting software may call your site from servers in another country. Block them and orders stop being marked as paid.
- Link previews. When someone shares your page on social media or in a chat app, that platform’s servers fetch it to build the preview, often from overseas.
A better way to do it
Instead of “block everyone outside Australia from everything”, do it in layers:
- Allow the important automated traffic first. A Skip rule at the top for verified bots and for your payment provider’s IP ranges.
- Block a short list of countries you never deal with across the whole site. Keep it short and review it.
- Protect sensitive pages more tightly, not the whole site. Your login page should be locked to your own trusted IPs regardless of country. Your forms can use a CAPTCHA such as Cloudflare Turnstile.
- Challenge rather than block the grey areas. A Managed Challenge on, say, your quote form for visitors outside Australia and New Zealand lets travellers through and slows bots down.
Name it, date it, review it
Country rules are the ones that go stale. Someone adds a country after a bad week, nobody remembers why, and two years later you’re blocking a market your sales team is trying to break into.
Give the rule a name that says what it does and when it was last reviewed, like block | all | countries we don't serve (reviewed 2026-09): the action, where it applies, and what it matches. Keep the reason for each country in your change log, and look at the list every six months.
And watch the events. If your country rule is blocking a steady trickle of what look like real visitors, that’s worth knowing. See How to test a new WAF rule without locking out customers.
Want help deciding which countries (if any) to block for your business? Get in touch.
