Blocking specific countries from accessing your website can be a useful security measure, especially if you're dealing with a high amount of spam or malicious traffic from certain regions. Cloudflare is a popular choice for website security and performance optimization, and it provides an easy way to block traffic from certain countries using its Firewall feature.
In this blog post, we'll go through the step-by-step process of blocking a country from accessing your website using Cloudflare.
Step 1: Log in to your Cloudflare account and select the website you want to block a country from accessing.
Step 2: Go to the "Firewall" tab and click on the "Firewall Rules" button. This will take you to the Firewall Rules page, where you can create and manage rules for blocking or allowing traffic.
Step 3: In the "Firewall Rules" page, click on the "Create a Firewall Rule" button. This will open the "Create a Firewall Rule" page, where you can specify the criteria for the rule.
Step 4: In the "Create a Firewall Rule" page, select "Country" from the "Criteria" dropdown menu. This will allow you to specify the country or countries you want to block.
Step 5: From there, you can select the specific country or countries you want to block by selecting them from the list or by entering their ISO code. You can also block multiple countries by clicking on the "Add another criterion" button and repeating the process.
Step 6: Once you've selected the countries you want to block, choose "Block" from the "Action" dropdown menu. This will block all traffic from the specified countries.
Step 7: Click on the "Save and Deploy" button to apply the rule. Your rule will now be in effect, and traffic from the specified countries will be blocked.
It's important to note that while Cloudflare's Firewall feature is a powerful tool for blocking traffic, it's not foolproof. Some VPN and proxy services can change the user's IP, so it might not be 100% effective. Additionally, if you're blocking a country with a large population, you may also be blocking legitimate traffic from users who are not malicious. Therefore, you should use the firewall feature with caution and be prepared to adjust your rules as needed.
Another way to block countries using Cloudflare is using Access Rules. Access Rules are a more advanced feature of Cloudflare, it allows you to create rules that determine which visitors can access your website.
Step 1: Go to the Cloudflare Access Dashboard Step 2: Create a new rule by clicking on the “Create a Rule” button Step 3: Select “Country” as the criteria Step 4: Select the countries you want to block Step 5: Select “Block” as the action Step 6: Save and deploy the rule
Access Rules are more granular and powerful than the Firewall rules and allows you to block not only by IP address or country but also by other attributes such as device type, browser, and user agent.
In conclusion, Cloudflare's Firewall and Access rules feature is a powerful tool that allows you to block traffic from specific countries. The process is relatively simple and can be done in just a few steps. However, it's important to use this feature with caution, as it can also block legitimate traffic. Additionally, using Access Rules can give you more control and granularity over the traffic. As always, be prepared to adjust your rules as needed.
Update: Where This Lives in the Cloudflare Dashboard Now
Cloudflare renamed and reorganised its security features, so if your dashboard does not match the steps above, here is the current path. “Firewall Rules” are now called WAF Custom Rules, found under Security → WAF → Custom rules in the Cloudflare dashboard. The mechanics are the same, and the country field is still ip.src.country.
Creating the rule (current UI)
- Log in to Cloudflare and select your domain.
- Go to Security → WAF → Custom rules, then click Create rule.
- Give the rule a name such as “Block unwanted countries”.
- Under If incoming requests match, set Field: Country, Operator: is in, and select the countries you want to block.
- Under Then take action, choose Block (or Managed Challenge, which shows a CAPTCHA-style challenge instead of a hard block — often the better first step).
- Click Deploy. The rule takes effect within seconds worldwide.
- Custom rules are available on free plans — Cloudflare’s free tier includes custom rules, so this does not require a paid plan for basic country blocking.
- Prefer Managed Challenge over Block where possible. Hard blocks also stop legitimate travellers, VPN users and expatriate customers; a managed challenge filters bots while letting humans through.
- Country blocking is not a complete security strategy. Attackers use proxies and compromised machines in allowed countries. Combine geo rules with Cloudflare’s Bot Fight Mode and rate limiting for real protection.
- Watch your analytics first. Check Cloudflare’s Analytics → Traffic by country for a week before blocking, so you do not cut off real customers — including search engine crawlers, which you should never block.
If you prefer the expression editor, the equivalent is:
(ip.src.country in {"KP" "SY"})