Firewall rules: block or redirect visitors by country

Firewall rules let you decide what happens to a visitor based on the country they are in. You can block them, so they see a short "not available in your region" page, or redirect them to another page, a folder of your site, or another website. The rules run before your redirects, your password and everything else, on every page and file.

It is on the Business plan. Open Settings, then Firewall under Hosting.

Add a rule

1. Under Firewall rules, choose the Action: Block or Redirect.
2. In Countries, type country names or two-letter codes separated by commas, for example Singapore, MY, Thailand. The matched countries appear under the box so you can check them.
3. Tick All countries except these if the rule should apply to everyone outside the list.
4. Leave Path empty for the whole site, or type /shop/* for a folder or /about for one page.
5. For a redirect, type where to send visitors in Send to: a page like /coming-soon, a folder like /uk/* (the rest of the address is kept, so /shop/hats becomes /uk/shop/hats), or a full https:// address.
6. Press Add. The rule reaches visitors within a few minutes.

Order matters

Rules run from the top. The first rule that matches a visitor decides, and the rest are skipped. Use Move up and Move down in a row's menu (the three dots) to change the order. Put narrow rules (one page, one country) above broad ones (the whole site, all countries except one).

Remove a rule

Open the row's menu and press Remove. Removing works on every plan.

Good to know

• Search engines and link previews have countries too. Google mostly visits from the United States, and so do the previews made by WhatsApp, Facebook and X. A rule that blocks or redirects the United States hides your site from them. Blocking a country also hides your site from its search engines.
• When we cannot tell a visitor's country, a rule listing specific countries does not apply to them, but an "all countries except these" rule does.
• A blocked visitor sees a plain page with your site's address and the words "This website is not available in your region." It cannot be customised.
• Redirects made by a firewall rule are temporary (302), so a browser forgets them as soon as you remove the rule.
• If your site moves to the Free or Pro plan, your rules stop running but stay in the list. They run again when the site is back on Business.
• A copy of the site starts with no rules.
• Firewall rules cannot block by IP address or by device. For protection against attacks, our network already does that for every site.