Restricted Country/Continent Option is not working properly

Hello Sahil,

Do you use a page other than wp-login.php for login like a custom login page or login page Plugin? Looking at the code that would affect wp-login.php, it should not be active on wp-login with the “Protect Login Authentication” option turned off. I also just tested it with the setting on and off and it worked as expected for wp-login.php though I did run into an issue if the setting “Block on All Pages” was active while Restrict on Login/Authentication was off, I will be releasing a patch for that soon as those two settings cannot be used together.

However, disabling Proxy & VPN Blocker for login/authentication does defeat much of the purpose of the plugin.

The Restrict Country/Continent option within the Plugin is something that predates the Custom Rules feature on your proxycheck.io dashboard, and I would suggest that you use that instead in this case. You can use it to block visitors from countries in much the same way, but you’d be able to whitelist the team members either by their IP Addresses or a specific geofence around the town/district they are in (though that would allow anyone from that area to also use the site). Understandably that isn’t too convenient but what you are trying to do (block all visitors but a few in some countries) is not easy to do.

Rick.

Hi Rick

There is no page other than wp-login.php for logins like a custom login page or login page Plugin.

Yes, there is an issue if the setting “Block on All Pages” was active while Restrict on Login/Authentication was off. It doesn’t work. That is the issue I am also explicitly pointing out.

It is specifically needed that “Block on all pages” need to be active while Restrict on Login/Authentication to be Off. And the wp-config page is required to be accessible. And accordingly, visitors from Blacklisted countries will not be able to access the website. But as we have turned Off the option, i.e., Restrict on Login/Authentication to be off, then at least our teammate (Admin, editor wp users) can access the Login/Authentication page.

I am curious to see a patch for your side soon. So that those two settings can be used together. Meanwhile, let me know how much it is going to take.

As there are some bad actors visiting our sites from a specific country. And, We can block them by setting that country in the restricted country option. They can’t even come from proxy IP because your excellent plugin option, i.e., “Block on all pages, ” to be active. But teammates from that country cannot access the wp-login.php login page so that they can log themself in and are out from restrictions while they work on the site. As Protect login authentication option being turned Off needs to work together with “Block on all pages”. Thanks in advance for the effort you are putting for this plugin.

Hi Sahil,

I put a check in the code for “Block on Login/Authentication”, if that setting is off and “Block on Entire Site” is on, then it should not now run on wp-login.php.

Please let me know if this helped.

Rick

Hi Rick,

It is working perfectly. Country blocking works perfectly with the turning on option, i.e., Block on Entire Site. And at the same time, teammates can easily log in to the website from wp-login.php as “Block on login/authentication” is Off.

But Login Authentication https://www.site.com/wp-admin/ is not working. The login page only comes after writing https://www.abc.com/wp-login.php. A regular user does login to the WordPress site either thru Login Authentication by writing https://www.site.com/wp-admin or https://www.site.com/wp-login.php

It is important that https://www.abc.com/wp-admin/ should also work. I am curious to see a patch for your side soon for the same too.

Sahil B.

• This reply was modified 2 years, 1 month ago by Sahil B. (Ph.D.).

Rick,

It is to inform you that it works perfectly for Admin account privilege. But when I tried to log in by editor/author/subscriber account. It is not working. The same VPN blocking restriction is functioning over there.

You did put a check in the code for “Block on Login/Authentication”, if that setting is off and “Block on Entire Site” is on, it doesn’t now run on wp-login.php only for the Admin account.

I believe you have added some code to make the admin account workable over there. It would be best if other accounts like editor/author/subscriber should also be able to access the WordPress dashboard.

Thanks for the effort.

• This reply was modified 2 years, 1 month ago by Sahil B. (Ph.D.).

Hi Sahil,

Thank you for letting me know, I am working on a solution for this now.

Hi @rickstermuk,

It is excellent that you are working on a solution for the same. But how long is it going to take? I am curious to implement the updated plugin on all my websites.

Regards,
Sahil B.

Hello Sahil,

1.10.4 has just been released, apologies for taking so long, it has been a busy couple of weeks and I had to do further testing on the Plugin changes.

You can now use “Allow Staff Bypass” on the advanced tab alongside “Protect on Login/Auth” being off. It is really not recommended that anyone uses the option to disable on login/auth but it may be useful for some users such as yourself.

Please let me know if this works for you,

Thank you,
Rick

Hi Rick,

I have updated the plugin to version 1.10.4. I completely understand your busy schedule. I have used the “Allow Staff Bypass” option “Protect on Login/Auth” being off. And it is working perfectly, and staff like the Editor/Author can log in to the website.

Your tool has done a great job at blocking VPN / proxies. We noticed that some people were able to use Google Translate (https://translate.google.com/) and visit our website even from the blocked countries list. Google translate is essentially a proxy server. You may also check the reference article for the same at https://www.onlinecmag.com/use-google-translate-proxy-server/.

For some reason, your tool did not block these requests. Do you know why this would be the case? Any help or suggestions would be greatly appreciated. Thanks!