Blocking Foreign Traffic

A single rule using the ip.country field is enough to block foreign traffic. Once saved, the rule propagates to all edge nodes within seconds.

Exempt search engines first

Search engine bots like Google and Bing crawl your site from data centers abroad. If you block all foreign traffic, your site may drop out of search results. In the steps below we first create an exemption rule and place it above the block rule.

Recipe 1: Allow only Türkiye

1. Open Console → WAF → [domain] → Rules.

2. Click New Rule and create the exemption rule first:

   • Rule name: search-allow (3–16 characters, alphanumeric, - and _)
   • Field: Bot Category (waf.client.bot_category) · Operator: equals (==) · Value: search
   • Action: Allow

   # Allow verified search engine bots
   IF   waf.client.bot_category == search
   THEN allow

   The allow action skips the remaining rules for matching requests, so this rule must come before the block rule.

3. Save the rule, then click New Rule again to create the block rule:

   • Rule name: foreign-block
   • Field: Country (ip.country) · Operator: not equals (!=) · Value: TR
   • Action: Block

   # Block all traffic from outside Türkiye
   IF   ip.country != TR
   THEN block

4. Save. In the rule list, verify that search-allow sits above foreign-block; if not, drag the row up to reorder. Rules are evaluated top to bottom.

Recipe 2: Block specific countries

If you want to block only specific countries rather than all foreign traffic, use the in operator. Country codes are 2-letter ISO 3166-1 codes (RU, CN, KP…).

1. Follow Console → WAF → [domain] → Rules → New Rule.

2. Enter the condition:

   • Field: Country (ip.country) · Operator: in list (in) · Value: the country codes to block

   # Block traffic only from selected countries
   IF   ip.country in RU, CN, KP
   THEN block

3. Select Block as the action and save.

Softer alternative: CAPTCHA

Instead of blocking outright, you can choose CAPTCHA as the action. Legitimate users from those countries (e.g. your customers abroad, VPN users) can pass the challenge and reach your site; automated tools usually cannot.

Test in log mode first

If you are unsure about the impact, select only the log action at first and watch traffic for a few hours. The rule’s hit counter and the access logs show exactly which traffic would be affected. Then update the action to Block.

Verification

• Connect through a VPN with a foreign location and try to access your site; you should see the HTTP 403 block page.
• On the Rules page, check that the rule’s hit counter is increasing.
• In Console → WAF → [domain] → Analytics, confirm in the country distribution that blocked requests originate abroad.
• Watch Google Search Console for crawl errors over the next few days.

Related Pages

Geographic Access RestrictionSyntax reference and advanced scenarios

ip.countryCountry field details and ISO codes