How to Block Countries from Accessing Your Website
A simple step-by-step guide using Cloudflare.
This guide from Content Merchants explains how to reduce spam, unwanted traffic, and unnecessary server load by blocking visits from selected countries inside Cloudflare. The setup is simple, practical, and does not require changes to your website code.
Why block countries?
A small rule can remove a lot of unnecessary traffic.
For brands focused on specific markets, country-level filtering is a practical way to protect forms, reduce low-value traffic, and keep infrastructure focused on the regions that matter most.
Improve website security
Limit unwanted traffic from regions that repeatedly trigger suspicious requests or attack attempts.
Control access by region
Decide which countries can reach your website based on where your audience actually needs access.
Save server resources
Reduce unnecessary visits that consume bandwidth, processing power, and support attention.
Reduce spam and bot traffic
Block high-noise regions early to lower form spam, login abuse, and low-quality automated hits.
What you need
Just a few basics before you begin.
You do not need advanced technical knowledge. If your website already runs through Cloudflare, the process is mostly about choosing the right dashboard area and applying a clear rule.
Step-by-step guide
Follow the setup in order and keep the rule simple.
Each step below mirrors the general Cloudflare flow. If labels move slightly over time, the logic stays the same: choose the country condition, set the action, and deploy carefully.
Log into Cloudflare
Open your Cloudflare account and choose the website where you want to limit access by country.
Tip: Make sure you select the correct domain if you manage more than one site.
Go to Security → WAF → Firewall Rules
From the dashboard, open the security tools and navigate to the firewall rules area where custom filtering rules are managed.
Tip: Cloudflare may update menu labels over time, but the rule builder stays in the security area.
Create a new rule
Start a new firewall rule so you can define who should be blocked before traffic reaches your website.
Tip: Use a clear rule name such as Block selected countries.
Set condition: Country “is in” selected countries
Choose the country field, set the condition to match the countries you want to block, and add them to the list.
Tip: Use country codes like CN or RU if you prefer the rule-expression view.
Set action to “Block”
Tell Cloudflare what to do when the rule matches. In this case, choose Block to deny access completely.
Tip: If you want to test first, you can use a softer action before switching to Block.
Save and deploy
Review the rule, save it, and deploy the change so it becomes active for incoming traffic.
Tip: Test from allowed regions afterwards to confirm legitimate visitors are still reaching the site.
Example rule
A simple expression can target selected countries.
In expression view, Cloudflare rules can reference the visitor country. The example below blocks traffic when the request comes from either China or Russia.
(ip.geoip.country in {"CN" "RU"})Replace the country codes with the countries you want to block, then pair the rule with the Block action.
Important notes
A country block helps, but it is not a complete security strategy.
Treat this as one practical layer in a wider security setup. Review your analytics, watch for legitimate user impact, and keep the rule aligned to the regions your business actually serves.
VPN users can sometimes bypass country-based blocking.
Be careful not to block legitimate customers or teams.
Always test after setup and monitor your traffic.
Content Merchants support
Need Help Setting This Up?
If you want an agency team to review your traffic quality, apply the rule safely, or help refine wider protection settings, connect this call to action to the Content Merchants enquiry flow.