IPGeolocation.io – Geo Redirects & Content Control decides what each visitor sees based on where they are and what IP address they are using. You can send people from one country to a different page, keep unwanted IP addresses away from your site or your login page, and show or hide parts of a page
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 5.8 and PHP 7.4.
SourceWordPress plugins · Nov 15, 2026
01 / Source details
Aboutthistool.
IPGeolocation.io – Geo Redirects & Content Control decides what each visitor sees based on where they are and what IP address they are using.
You can send people from one country to a different page, keep unwanted IP addresses away from your site or your login page, and show or hide parts of a page depending on the visitor’s location. Everything is set up from one settings screen, and you do not need to write any code.
The plugin uses the ipgeolocation.io API to work out a visitor’s country and other details. Results are stored for 24 hours per address, so your site stays fast.
Main Features
Country-based redirects (entire site, specific pages, or URL patterns)
Optional popup confirmation before redirect
IP address blocking, with separate rules for your website and your login page
Address lists that accept single addresses, ranges, wildcards, IPv4 and IPv6
Safe list of addresses that are never blocked by any rule
Protection against locking yourself out, with a recovery option
Country-level access control (allow or block)
Conditional content shortcodes
Output visitor geolocation data via shortcode
Page and query-string exclusions
Redirect bypass and reset via URL parameters
Bot detection (search engines and social crawlers excluded from redirects)
Administrator-safe (admins are never redirected)
IP response caching using WordPress transients
Blocking Visitors By IP Address
The IP section asks two questions, and you answer them separately:
For each one, you can leave it open to everyone, block a list of addresses, or allow only a list of addresses. Locking the login page to your office address is a simple way to stop password guessing bots, and ordinary visitors are not affected at all.
IP rules are checked before any location lookup, so blocking somebody uses none of your API credits.
Configuration
The plugin supports the following API plans from ipgeolocation.io:
Developer (Free)
Paid
On a Paid plan you can also turn on Include security data under Plan Type. It adds proxy, VPN, Tor and threat score details to each lookup and uses extra API credits. Only the security shortcode fields need it; country redirects and access control do not.
Blocking by IP address does not need an API key. Everything based on country does.
Shortcodes
Display Single Geolocation Field
[ipgeo country] [ipgeo city] [ipgeo country_code]
Available fields include: ip, city, state, country, country_code, zipcode, continent, latitude, longitude, currency, calling_code, languages, is_proxy, is_tor, is_anonymous, cloud_provider
Conditional Content (Show If Match)
[ipgeo_if country_code="US,CA" logic="OR"]Visible to visitors from the US or Canada.[/ipgeo_if]
[ipgeo_if_not country="Germany"]Hidden from visitors in Germany.[/ipgeo_if_not]
Both shortcodes accept the same attributes, so you can hide content from one country just as easily as showing it to another.
Redirect Bypass
For testing or user control, redirects can be bypassed:
?geo_bypass=1 bypasses redirects for 30 days. Use it in links that let visitors choose this site, for example a “Visit our international store” link on your other site
?geo_reset=1 forgets everything the plugin remembers about the visitor: earlier redirects, popup answers and bypasses
Both are removed from the address bar once read, so they do not end up in shared links.
This does not affect IP rules.
External Services Used
This plugin connects to two outside services.
ipgeolocation.io
Used to find the country, region, city and security details for a visitor’s IP address. This powers country redirects, country access control and the shortcodes.
The visitor’s IP address and your API key are sent to https://api.ipgeolocation.io/v3/ipgeo when a page needs location data. Results are stored for 24 hours per address, so a returning visitor does not cause a second request. Nothing is sent if you have not entered an API key, and nothing is sent for a visitor already blocked by an IP rule.
An API key is required. You can get one by creating a free or paid account at ipgeolocation.io . Without it, the country-based features will not work.
Terms of service: https://ipgeolocation.io/tos.html Privacy policy: https://ipgeolocation.io/privacy.html
Cloudflare
Used only to keep an up-to-date list of Cloudflare server addresses. The plugin needs this list to tell whether a Cloudflare header can be trusted. Without it, that header could be faked by anyone.
Once a day the plugin requests https://www.cloudflare.com/ips-v4 and https://www.cloudflare.com/ips-v6 . No visitor information, site information or personal data is sent. If the request fails, a copy included with the plugin is used instead. This only happens when address detection is set to Automatic or Cloudflare.
Terms of service: https://www.cloudflare.com/website-terms/ Privacy policy: https://www.cloudflare.com/privacypolicy/
License
This plugin is licensed under the GPL v2 or later.
See it in action
Screenshots & previews.
Country redirect rules settingsRedirect confirmation popupCountry access control settingsConditional content shortcodesIP access control, showing your own address and the two access questions
02 / Source details
Gettingstarted.
01Upload the plugin folder to /wp-content/plugins/ .
02Activate the plugin via Plugins → Installed Plugins .
03Enter your ipgeolocation.io API key in the plugin settings.
04Configure redirect rules, exclusions, country access rules, or IP rules.
03 / Source details
Frequently asked questions.
Does this plugin redirect logged-in administrators?
No. Administrators are automatically excluded from redirects, and by default they are never blocked by IP rules either. You can change that in Advanced settings.
Are bots and search engines redirected?
Known bots (Google, Bing, Facebook, X and others) are excluded from country redirects. IP rules do not skip them, because any browser can claim to be a search engine. To exempt a crawler from an IP rule, add its addresses to your safe list.
Does the plugin cache API responses?
Yes. IP data is cached for 24 hours per IP.
How do I lower the number of API credits used?
If you only redirect or block by country, turn off Include security data under Plan Type. Each lookup then fetches location data only. Developers can change the request further with the ipgeo_api_args filter, and how long results are cached with the ipgeo_cache_ttl filter.
Does it work with Cloudflare?
Yes. Choose the Cloudflare option under Advanced settings. The plugin only trusts Cloudflare’s headers when the request genuinely came from a Cloudflare server, so nobody can pretend to be at a different address.
Will this slow down my site?
No. API results are cached, and IP rules are a simple local check with no lookup involved.
Do I need an API key to block IP addresses?
No. Blocking by IP address works without a key. Country features need one.
How do I find my own IP address?
The settings screen shows it at the top of the IP section, with a button that adds it to your safe list.
The plugin shows the wrong IP address for me. Why?
Your site is probably behind a CDN or proxy, which replaces the address your server sees. Open Advanced settings and choose the option that matches your setup, then check the address again after saving.
I locked myself out of my login page. How do I get back in?
Add this line to your wp-config.php file, log in, fix the rule, then remove the line:
define( 'IPGEO_DISABLE_IP_ACCESS', true );
The plugin normally refuses to save a rule that would lock you out, so this should be rare.
Does it work with a caching plugin or CDN?
Yes, since 1.3.0. A page cache serves a stored copy of a page without running WordPress, so a visitor’s country cannot be checked while the page is built. With “Cached page support” on (the default), every page carries a small script that asks your site what to do for each new visitor, using the same rules the server uses, and then remembers the answer. It works with WP Rocket, LiteSpeed Cache, W3 Total Cache, WP Super Cache, Cloudflare, Varnish, and host caches alike. Visitors on uncached pages are still redirected instantly by the server.
Can I block countries or IP addresses on a cached site?
Only if blocked visitors are never served a cached copy. While visitor blocking rules are active, the plugin stops public pages from being cached (Settings > Page caching). If you would rather keep caching, enforce the block at your CDN instead, for example with a Cloudflare WAF rule, and turn that option off. Sites that already had blocking rules active when they updated to 1.3.0 keep their previous behaviour until they turn it on.
Why was a visitor not redirected?
Use “Test a visitor” at the bottom of the settings page, or define IPGEO_DEBUG as true in wp-config.php: every response then carries an X-IPGeo-Decision header naming the reason, such as excluded, already_redirected or no_rule_for_country.
Can one rule cover several countries?
Yes. Enter the codes separated by commas, for example GR, CY.
How often is the same visitor redirected?
You choose, above the redirect rules: every visit (the default for new installs), once per browser session, once per hour or once per day. Each rule can override it under How Often, for example every visit for your local store and once per day for a promotion. Sites that used the plugin before 1.4.0 keep once per hour, the earlier behaviour, until they change it. Visitors who choose to stay, through a ?geo_bypass=1 link or by answering “No” to a popup, are never redirected for 30 days.
What does a popup remember?
The answer, for 30 days. “Yes” sends the visitor to the other site automatically on later visits, “No” keeps them on this one. If you change the destination of the rule, visitors are asked again. Closing the popup without answering asks again in the next browser session.
Why does ?ipgeo_from=1 appear in the address after a redirect?
It is added when a visitor is sent to another site. If that site also runs this plugin, it stops the two sites from sending the visitor back and forth, and the plugin there removes it from the address bar. If the other site does not run this plugin, nothing can remove it there: switch off “Add ?ipgeo_from=1 when sending visitors to another site” above the redirect rules.
How do I test redirects with a VPN?
Use a private browser window, and open a new one after changing location. Or add ?geo_reset=1 to the address, which clears everything the plugin remembers about you.
FinderPress Media Auditor helps site administrators scan for broken images, missing Media Library files, unreachable media URLs, and other media issues across WordPress content. Use it to audit images, video, audio, PDFs, featured images, and attachment files without sending scan data to an external
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
