What country blocking in Cloudflare does
If you need to restrict access by geography, Cloudflare gives you several ways to block or challenge requests based on the visitor’s country.
This guide explains how to block country traffic in Cloudflare, when to use each method, and what to watch for before you enforce a block.
Country-based filtering is useful for reducing spam, limiting abuse, and enforcing business or licensing rules, but it can also affect legitimate users if you apply it too broadly.
Why businesses block traffic by country
Organizations commonly use geo-blocking for security, compliance, and operational reasons.
Cloudflare can help reduce unwanted traffic at the edge before it reaches your origin server.
- Fraud prevention: reduce signups, checkout attempts, or login abuse from regions that generate high-risk traffic.
- Attack surface reduction: limit exposure to bots, credential stuffing, and scripted attacks from specific countries.
- Compliance and licensing: enforce geographic restrictions required by contracts, copyright, or local laws.
- Operational control: prioritize service availability for supported markets and reduce noise from irrelevant traffic.
How Cloudflare identifies visitor country
Cloudflare uses IP geolocation to determine the visitor’s country.
The country signal is derived at the edge, so the request can be handled before it is forwarded to your origin.
This makes Cloudflare suitable for blocking, challenging, or allowing requests by country without changing your application code.
Keep in mind that geolocation is based on IP intelligence, which is generally accurate but not perfect.
VPNs, proxies, mobile networks, and shared infrastructure can make a visitor appear to be in a different country.
Best ways to block country traffic in Cloudflare
There are multiple ways to implement country restrictions in Cloudflare.
The right choice depends on whether you want to block traffic, challenge it, or simply observe it first.
1. Use WAF custom rules
Cloudflare’s Web Application Firewall custom rules are the most flexible option for country-based control.
You can create a rule that matches a visitor’s country and then choose an action such as block, challenge, or managed challenge.
A typical expression uses the ip.geoip.country field.
For example, to block a country, you can match the two-letter ISO country code in a rule condition and apply a block action.
Example logic:
- If country equals
CN, block the request. - If country equals
RU, challenge the request. - If country is not in your approved list, block or log it.
This approach is ideal when you want precise control and the ability to combine country matching with other conditions such as hostname, URI path, user agent, or ASN.
2. Use Firewall rules for simpler enforcement
Depending on your Cloudflare plan and account configuration, firewall rules or related security rules may still be available in certain setups.
These are useful if you want a straightforward country block without building a more complex policy.
For many teams, a simple allowlist is easier to manage than a denylist.
Instead of blocking dozens of countries, allow only the countries where you do business and block everything else.
3. Use allowlists for tighter control
If your service serves a narrow audience, an allowlist strategy can be safer than blocking individual countries.
For example, a B2B dashboard for U.S. and Canadian customers may only allow traffic from those two countries.
This approach reduces the chance of forgetting to block a new source region, but it requires careful maintenance if your user base expands internationally.
4. Combine country rules with bot and rate controls
Country blocking works best as part of a layered defense.
Many teams combine geo rules with bot management, rate limiting, or authentication controls to make attacks more expensive and less effective.
- Block high-risk countries at the edge.
- Challenge suspicious traffic from allowed countries.
- Rate limit login, signup, and password reset endpoints.
- Require stronger authentication for sensitive actions.
How to create a country block in Cloudflare
The exact steps vary slightly by Cloudflare plan and dashboard updates, but the general workflow is consistent.
- Log in to the Cloudflare dashboard and select your site.
- Open the security section for WAF or custom rules.
- Create a new rule with a country-based expression.
- Select the action, such as block, managed challenge, or JS challenge.
- Save, deploy, and verify the rule using analytics or test requests.
Before enforcing a block on production traffic, test the rule in logging or challenge mode if possible.
That helps you confirm the rule matches the intended geography without unexpectedly denying legitimate users.
Example Cloudflare expressions for country filtering
Cloudflare expressions are built around request attributes.
The following patterns are commonly used when learning how to block country traffic in Cloudflare.
Block one country?
To block a specific country, match its ISO code in the country field and set the rule action to block.
(ip.geoip.country eq "CN")Allow only selected countries?
If you want an allowlist approach, you can combine country checks with logical operators.
(ip.geoip.country in {"US" "CA" "GB"})Then use a separate block rule for requests that do not match your approved list.
Exclude internal users or trusted paths?
You can narrow the impact of a geo rule by adding path or hostname conditions.
(ip.geoip.country eq "BR" and http.request.uri.path contains "/admin")This is useful when only certain areas of a site need country restrictions.
Where country blocking works well
Geo-blocking is most effective when access is naturally limited by region or when abuse is concentrated in a few countries.
It is also useful for temporary mitigation during active attacks.
- Private dashboards: internal tools accessed only from a few offices or countries.
- Content licensing: region-restricted media, downloads, or product pages.
- High-abuse endpoints: signup, login, coupon, and contact forms.
- Emergency response: rapid blocking during a bot campaign or targeted abuse wave.
Risks and limitations to consider
Blocking by country is effective, but it is not a complete security strategy.
Users traveling abroad, VPN users, and legitimate cloud providers may trigger false positives.
Some countries also share internet infrastructure, which can complicate regional filtering.
Before enabling a block, consider how people might be affected and whether a challenge would be more appropriate than a hard deny.
A managed challenge can preserve access for real users while filtering automated traffic.
- False positives: legitimate users may appear to come from the blocked country.
- Evasion: attackers can use VPNs or proxies to change location.
- Business impact: you may unintentionally block customers, partners, or search engine crawlers.
- Maintenance: geo rules should be reviewed as your market changes.
How to verify that your rule is working
After deployment, use Cloudflare analytics and security event logs to confirm the rule is matching the expected traffic.
Review blocked or challenged requests by country, path, and user agent to make sure the policy is doing what you intended.
If you notice legitimate traffic being stopped, refine the rule with additional conditions or move from block to challenge.
For business-critical pages, test from approved networks before rolling out broader restrictions.
When to use alternatives to country blocking
Country filtering is not always the best answer.
If your goal is to stop abuse rather than deny geographic access, Cloudflare offers other controls that may be more precise.
- Rate limiting: slows repeated requests to sensitive endpoints.
- Bot management: identifies automated traffic patterns.
- Access policies: protects internal tools with identity-based controls.
- mTLS or authentication gates: verifies trusted clients instead of location.
For many environments, a layered policy that combines country restrictions with behavioral controls produces the best balance of security and usability.