How to Block Visitors by Country or IP Address in StackCP

StackCP's Block Visitors tool lets you control exactly who can reach your website — by country, by individual IP address, or by a whole range of IP addresses using CIDR notation. It's a flexible tool used both for basic security (blocking known bad actors) and for business reasons, such as restricting a site to visitors in the regions you actually serve.

This guide explains both use cases and how to configure them without accidentally blocking real customers or search engines.

What Does Block Visitors Actually Do?

Block Visitors gives you two independent ways to control access to your website:

Blocking by country, using GeoIP data — StackCP determines the country a request originates from based on its IP address, and can block or allow access based on that. You can configure this in either direction:

• Allow all countries, with exceptions (block specific countries while allowing everyone else).
• Block all countries, with exceptions (block everyone except the specific countries you allow) — useful if your business only serves customers in one country or region.

Blocking by IP address or CIDR range — you can enter specific IP addresses, or ranges using CIDR notation, to block particular visitors or networks regardless of their country.

Why This Matters for Your Website

• Security. Blocking a specific IP or range that's repeatedly probing your login page or scraping your content stops that activity outright.
• Business relevance. If you only sell to customers in India, for example, blocking traffic from regions you don't serve can reduce irrelevant traffic, spam form submissions, and bandwidth usage from visitors who were never going to become customers.
• Reducing bot and spam traffic originating disproportionately from specific regions or known problematic IP ranges.

An Important Warning Before You Start

Blocking a country or region can have side effects you should know about before configuring anything: blocking certain regions may hinder Google's ability to index your site, since crawler requests can originate from data centers in blocked regions. If your SEO visibility matters to you — and for almost every business it does — think carefully before blocking large regions, and consider testing with a narrower configuration first, or blocking by IP/CIDR instead of by country if your concern is a specific bad actor rather than an entire region.

Step 1: Open Block Visitors in StackCP

1. Log in to your StackCP dashboard.
2. Go to Manage Hosting, then Manage on the site you want to configure.
3. Find and select Block Visitors under the Security section.

Step 2: Configure Country-Based Blocking

1. Choose your overall approach: allow all countries with exceptions, or block all countries with exceptions.
2. If you're restricting your site to specific regions (for example, a business that only serves customers within India), select "block all, with exceptions," then add India as an allowed exception.
3. If you simply want to exclude a small number of specific countries associated with spam or abuse on your site, select "allow all, with exceptions," and add those countries to your block list.
4. Save your changes.

Start conservatively. If you're unsure whether a broader block will affect your legitimate traffic or search visibility, begin with a narrower list and review your traffic and search console data afterward, rather than blocking broadly from day one.

Step 3: Block a Specific IP Address or CIDR Range

If your concern is a specific attacker or bot rather than an entire country:

1. In the same Block Visitors screen, find the option to add a specific IP address or CIDR range.
2. For a single IP, enter the address directly (e.g., 203.0.113.45).
3. For a range, use CIDR notation — for example, 192.168.0.0/24 blocks all 256 addresses between 192.168.0.0 and 192.168.0.255.
4. Save your changes.

This is generally the more precise, lower-risk option compared to blocking an entire country, since it targets only the specific source causing a problem.

Step 4: Identify What You're Actually Blocking First

Before blocking anything — country or IP — it helps to know what you're dealing with. Useful sources include:

• Access/error logs, which often show repeated requests from the same IP, especially around login pages.
• Traffic or spam patterns you notice directly (repeated contact form spam from a specific region, unusual failed-login attempts).

Write down what you plan to block and roughly why, before making the change — this makes it much easier to review your configuration later and remember your own reasoning.

Step 5: Review Your Configuration Periodically

Blocklists — both country-based and IP-based — are worth revisiting periodically:

• IP addresses are frequently reassigned over time; an address you blocked months ago may now belong to a different, legitimate visitor.
• Your business's served regions may expand over time, in which case a country-level restriction set up early on may need updating.

A quick review every few months keeps your configuration aligned with your actual business needs.

Common Mistakes Beginners Make

• Blocking an entire country without checking the indexing impact first. Search engine crawlers can be affected, which can hurt your SEO if you're not careful.
• Using country blocking when the real problem is a single bad actor. A narrower IP/CIDR block is usually the more precise, lower-risk fix.
• Forgetting you've blocked a region and later wondering why traffic from a legitimate new market isn't showing up. Document your blocks and review them periodically.
• Blocking overly broad IP ranges that may cover more legitimate users than intended, particularly ranges belonging to large ISPs or mobile carriers.

Troubleshooting

"A legitimate customer says they can't access my site." Check both your country block list and your IP/CIDR block list — the issue could be either, depending on their location and connection type.

"My site seems to have dropped out of some search results after blocking a region." This is a known risk of country-level blocking, since search engine crawlers can be affected if they connect from a blocked region. Consider narrowing your block list, or switching from a country-level block to a more targeted IP/CIDR block if possible.

"I'm not sure which specific IP to block." Check your access logs for repeated, suspicious request patterns from the same source before deciding — our companion guide on reading access and error logs covers this in more detail.

Understanding CIDR Notation (Without the Jargon)

If you're new to CIDR notation, the concept is simpler than it looks. An address like 203.0.113.0/24 means: "block this entire range of 256 consecutive IP addresses, starting from 203.0.113.0." The number after the slash indicates the size of the range — a smaller number after the slash means a larger range of addresses, and vice versa. As a beginner, you'll rarely need anything wider than a /24 for blocking a specific problematic source; StackCP's Block Visitors tool accepts both individual IPs and CIDR ranges directly, so you don't need external tools to calculate or apply them.

Country Blocking as a Business Decision, Not Just a Security One

It's worth emphasizing that country-level blocking in StackCP isn't purely a security feature — for many small businesses, it's a practical business decision. If you run a local service business, a regional e-commerce store, or a site that only ships within India, blocking (or simply not actively marketing to) other regions can reduce noise in your analytics, cut down on irrelevant spam form submissions, and in some cases reduce bandwidth consumption from visitors who were never going to convert. This is a different rationale from blocking a specific attacker, and it's worth deciding upfront which goal you're solving for, since the right configuration differs depending on the answer.

Balancing Security With Accessibility

As with most access-control tools, there's a genuine trade-off between locking things down and staying accessible to legitimate visitors and search engines. A useful approach for beginners:

1. Start with IP/CIDR blocking for specific, confirmed problems — this is the lowest-risk option since it targets only what you've actually identified as an issue.
2. Only move to country-level blocking if you have a clear, ongoing business reason — such as genuinely only serving one country — rather than as a general-purpose security measure.
3. Monitor your search visibility (via Google Search Console, if you use it) after any country-level change, so you can catch and reverse an unintended indexing impact quickly rather than months later.

Managing This Across Multiple Customer Sites

If you manage hosting for multiple customers, each with their own Block Visitors configuration needs, it's worth keeping a simple record — even just a shared spreadsheet — of which sites have country or IP restrictions in place, and why. This becomes especially useful when a customer later asks "why can't my cousin in Dubai see my site," and you need to quickly check whether a country-level block is the cause, rather than searching through StackCP settings for every package one by one.