Geo blocking

Geo blocking rejects sign-in and sign-up when the request comes from a country you have marked. It is a country list, not a fraud score. A user on a VPN in an allowed country still gets through. A user at home in a blocked country does not.

Block a country

1. Open the console and select the environment.
2. Go to Authentication > Policies > Countries.
3. Click countries on the map. The selection is amber.
4. Open Review & confirm to add them as blocked. Blocked countries turn red.
5. Click a red country to remove it. Clear all drops the list.

Sign-in and sign-up from a blocked country fail with "Sign-in is not available from your country." An empty list blocks nobody. Saving a list enables the policy.

The country comes from the edge (cf-ipcountry). Unknown networks covers Cloudflare XX (unknown) and T1 (Tor). They are not countries, so a pin on the map does not match them. Set Unknown networks on the same tab:

A hosting provider or VPN in an allowed country still looks like that country. Pair this list with bot detection when the exit node is the problem.

What it does not do

• It does not sign out a session that was issued before you blocked the country. Shorten token lifetime if a block must take effect quickly for people already signed in.
• It does not replace an email allowlist. A contractor in an allowed country with a personal domain is an access control problem.
• It does not follow the user after they connect through an exit node somewhere else. Pair it with device risk if impossible travel matters.

Test from a network you expect to block before you rely on the list. A wrong click on a large country locks out everyone there, including you, if you are deploying from that country.

Related