Skip to main content

IP Blocking

IP blocking lets you prevent specific IP addresses, IP ranges, or entire countries from accessing your store.

Why Block IPs?​

Block IPs when you see:

  • Persistent scrapers - Same IP hitting your store repeatedly
  • Suspicious activity - Unusual patterns from specific IPs
  • Fraudulent orders - Known fraud sources
  • Geographic risk - Countries you don't ship to anyway
  • Bot attacks - DDoS or scraping attacks

Blocking Options​

Block Specific IPs​

Block individual IP addresses:

  • 192.168.1.1
  • 10.0.0.50

Best for: Known bad actors, specific threats

Block IP Ranges (CIDR)​

Block ranges of IPs using CIDR notation:

  • 192.168.0.0/24 (blocks 192.168.0.1 - 192.168.0.254)
  • 10.0.0.0/16 (blocks 10.0.0.1 - 10.0.255.254)

Best for: Blocking hosting providers, entire networks

Block Countries​

Block all visitors from specific countries:

  • Select countries from the dropdown
  • Uses visitor's IP to determine location

Best for: Regions you don't serve, high-fraud areas

Block VPNs​

Block visitors using VPN services:

  • Detects most commercial VPN providers
  • Helps prevent fraud and circumvention

Best for: Reducing fraud, preventing ban evasion

Block Datacenters​

Block visitors from cloud/datacenter IPs:

  • Most real shoppers don't browse from datacenters
  • Catches many bots and scrapers

Best for: Bot prevention, scraper blocking

How to Configure​

Adding Blocked IPs​

  1. Go to IP Blocking in the sidebar
  2. Enter IP addresses (one per line) or use CIDR notation
  3. Click Add to Block List

Blocking Countries​

  1. Go to IP Blocking in the sidebar
  2. Scroll to Blocked Countries
  3. Select countries from the dropdown
  4. Click Save

Adding VPN/Datacenter Blocking​

  1. Go to IP Blocking in the sidebar
  2. Toggle Block VPN and/or Block Datacenter
  3. Click Save

Whitelist​

Sometimes you need to allow specific IPs even when broader rules would block them.

When to Whitelist​

  • Your own IP address
  • Your team's office IPs
  • Legitimate service providers
  • Testing and QA IPs

How to Whitelist​

  1. Go to IP Blocking in the sidebar
  2. Add IPs to the Allowed IPs section
  3. Click Save

Whitelisted IPs bypass all blocking rules.

What Blocked Visitors See​

When someone is blocked, they see:

  • A clean "Access Denied" message
  • No mention of the specific reason
  • No way to bypass (unless they change IP)

You can customize this in your settings.

Viewing Blocked Activity​

IP Blocking Activity​

See all blocked access attempts:

  • IP address blocked
  • Country (if geo-blocked)
  • Reason for block
  • Page they tried to access
  • Timestamp

Analytics​

See blocking statistics:

  • Total blocks this period
  • Blocks by country
  • Blocks by reason

Best Practices​

Don't Over-Block​

  • Start with specific IPs, not countries
  • Monitor false positive reports
  • Only block countries you truly don't serve

Use Data to Decide​

  1. Check Bot Detection for repeat offender IPs
  2. Check Spy Detection for competitor IPs
  3. Check Fraud Orders for fraud source IPs
  4. Add those IPs to your block list

Combine with Other Protections​

IP blocking is most effective when combined with:

  • Bot Detection - Find IPs to block
  • Content Protection - Extra defense layer
  • Fraud Detection - Block fraud sources

Review Regularly​

  • Old blocks may no longer be relevant
  • IPs can change ownership
  • Countries can become relevant markets

Country Blocking Considerations​

Geographic Reality​

  • Blocking a country blocks ALL visitors from there
  • Including potential customers
  • Including ex-pats and travelers

When Country Blocking Makes Sense​

  • You don't ship to that country at all
  • High fraud rates from that region
  • Legal restrictions on selling there
  • No legitimate business reason for visits

Alternatives to Country Blocking​

  • Block only datacenter IPs from that country
  • Block VPNs instead of countries
  • Use fraud detection instead

FAQ​

Q: Will blocking IPs affect my SEO? A: If you block Googlebot's IPs, yes. We provide common search engine IPs to avoid this. Don't block major search engines.

Q: How quickly do blocks take effect? A: Within 1-2 minutes of saving your configuration.

Q: Can blocked visitors tell why they're blocked? A: They see a generic access denied message. No specifics are revealed.

Q: What about dynamic IPs? A: Users with dynamic IPs may get new IPs. Block CIDR ranges for persistent offenders, or use other detection methods.

Q: Can I see who's being blocked? A: Yes, the IP Blocking Activity page shows all blocked attempts in real-time.

Q: Will this block mobile users? A: Mobile users have IP addresses too, so yes. Be careful with broad country blocks that might affect mobile customers.