How to Block Countries from Accessing Your Website using cPanel

Restricting access to your website based on geographic location (GeoIP blocking) is a powerful, proactive way to protect your site against localised cyberattacks, automated brute-force attempts, and unauthorised web scraping.

Because UpTime Web Hosting runs high-performance LiteSpeed Web Server with CloudLinux, you can implement country blocking directly at the web server level using your website's .htaccess file. Processing these blocks at the web server layer is vastly superior to traditional heavy PHP plugins, as LiteSpeed drops unwanted traffic before it ever consumes application CPU or memory.

Blocking Countries via LiteSpeed GeoIP Environment Variables

LiteSpeed Web Server natively parses MaxMind GeoIP2 databases, passing location metadata directly to Apache rewrite environment variables. This allows you to write clean, lightweight rules directly inside your .htaccess file using 2-letter ISO country codes (e.g., AU for Australia, US for United States, CN for China, RU for Russia).

Step 1: Locate or Create Your .htaccess File

1. Log in to your cPanel dashboard.

2. Open File Manager under the Files section.

3. Navigate to your website's document root directory (usually public_html).

4. Click Settings in the top-right corner, check Show Hidden Files (dotfiles), and click Save.

5. Edit or create the .htaccess file.

Option A: Block Access from Specific Countries

To block visitors from specific countries (e.g., China and Russia) while allowing traffic from everywhere else, add the following code to the top of your .htaccess file:

# Block specific countries using LiteSpeed GeoIP
RewriteEngine On
RewriteCond %{ENV:GEOIP_COUNTRY_CODE} ^(CN|RU)$ [NC]
RewriteRule ^ - [F,L]

• GEOIP_COUNTRY_CODE: Inspects the visitor’s incoming IP against the server’s GeoIP database.

• ^(CN|RU)$: Specifies the ISO 3166 2-letter country codes to block (separated by pipe | symbols).

• [F,L]: Returns an instant 403 Forbidden HTTP status code and stops processing further rewrite rules.

Option B: Allow Access ONLY from Specific Countries (Geo-Fencing)

If your business strictly serves an Australian and New Zealand audience and you want to prevent all international traffic, you can restrict access so only specified countries are permitted:

# Allow ONLY Australia and New Zealand, block all others
RewriteEngine On
RewriteCond %{ENV:GEOIP_COUNTRY_CODE} !^(AU|NZ)$ [NC]
RewriteRule ^ - [F,L]

• The ! symbol acts as a NOT operator. If the visitor's country code is not AU or NZ, LiteSpeed immediately rejects the connection with a 403 Forbidden response.

Option C: Block Overseas Traffic to Sensitive Pages Only (e.g., WordPress Admin)

If you operate an international blog or store but want to protect your administrative login page (wp-login.php) and XML-RPC interface (xmlrpc.php) from overseas brute-force bots, apply this targeted rule:

# Protect WordPress login from non-Australian visitors
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/(wp-login\.php|xmlrpc\.php)$ [NC]
RewriteCond %{ENV:GEOIP_COUNTRY_CODE} !^(AU)$ [NC]
RewriteRule ^ - [F,L]