Deerwood Country Access
Country blocking and intelligent IP protection for WordPress, with optional Cloudflare edge protection.
Deerwood Country Access is a lightweight WordPress security plugin that helps website owners control geographic access, detect abusive traffic, rate-limit suspicious requests, identify repeat offenders, and optionally move protection to Cloudflare's edge.
Control Who Reaches Your WordPress Website
Country Access provides several layers of protection without requiring you to manually build and maintain complicated firewall rules.
Country Access Control
Allow only selected countries or block specific countries from accessing your WordPress website.
Cloudflare Edge Protection
Connect Cloudflare and move supported blocking to the edge, stopping unwanted traffic before it reaches WordPress or your origin server.
Smart Rate Limiting
Track suspicious request activity and temporarily restrict abusive visitors before they become a larger problem.
Repeat-Offender Protection
Identify IP addresses that repeatedly trigger security controls and automatically apply stronger protection.
Security Activity Logging
Review locally blocked requests including the visitor, country, requested path, detection method, and reason the request was blocked.
Administrator Safety
Trusted IP exceptions, protection controls, and administrator anti-lockout safeguards help reduce the chance of accidentally blocking yourself.
Verified Search Engines
Cloudflare-verified search engines and trusted bots such as Googlebot and Bingbot can bypass the Country Access edge rule.
Local Protection
Cloudflare is optional. Country Access can enforce geographic restrictions directly inside WordPress when Cloudflare edge protection is not being used.
Simple Cloudflare Connection
Connect through Cloudflare OAuth without manually creating, copying, or storing API tokens yourself.
Security Without Artificial Feature Gating
Deerwood Country Access is available as a free WordPress plugin. The protection features included with the plugin are available without requiring a subscription or trial.
Install the plugin, review your country settings, enable the protection you need, and optionally connect Cloudflare if you want blocking moved closer to the edge.
Included
- Country allow and block rules
- Local WordPress protection
- Cloudflare integration
- Cloudflare OAuth connection
- Managed WAF rule
- Rate limiting
- Repeat-offender detection
- Trusted IP addresses
- Security activity logging
- Verified bot protection
- Administrator safety controls
Optional Cloudflare Integration
Cloudflare is not required. Deerwood Country Access can protect your website locally inside WordPress.
When Cloudflare is connected, supported geographic and repeat-offender blocking can happen before the unwanted request reaches WordPress or your origin server.
This can significantly reduce the amount of unwanted traffic PHP and WordPress need to process.
The connection uses Cloudflare OAuth, so administrators do not need to manually create or paste API tokens into WordPress.
Geographic restrictions and supported repeat-offender IP addresses are combined into a managed Cloudflare firewall rule and updated in place.
Country Access manages its own protection rule rather than continually creating new firewall rules.
Country Access does not intentionally modify or delete unrelated Cloudflare firewall rules.
WordPress Protection + Cloudflare Protection
Country Access can protect the website locally, at Cloudflare's edge, or use the two together.
WordPress Protection
Requests reach your server and Country Access evaluates them before normal WordPress processing continues.
This works even when your website does not use Cloudflare.
Cloudflare Protection
Supported blocked traffic can be rejected by Cloudflare before the request reaches your web server.
This reduces unnecessary requests reaching PHP, WordPress, plugins, and your hosting environment.
Search Engine Safety
By default, Country Access can allow Cloudflare-verified search engines and trusted bots such as Googlebot and Bingbot to bypass the Country Access edge rule.
This does not simply trust the visitor's User-Agent. When Cloudflare edge protection is enabled, Country Access uses Cloudflare's verified bot signal.
This helps prevent an attacker from bypassing your country protection simply by pretending to be Googlebot.
Verified, not assumed.
Trusted crawlers can be identified through Cloudflare's verified bot signal instead of easily spoofed browser headers.
You Control When Protection Starts
Installing Country Access does not immediately begin blocking visitors.
Protection remains disabled until a WordPress administrator reviews the settings and explicitly enables it.
New installations are preconfigured for Allow Only mode with Canada and the United States selected. These settings should always be reviewed before protection is enabled.
Review before enabling.
Country blocking is powerful. Confirm your location, trusted IP settings, and Cloudflare configuration before turning protection on.
Lockout Warning
Country Access can restrict access to your website at both the WordPress and Cloudflare levels. Incorrect country, IP, or firewall settings can prevent you or legitimate visitors from reaching the website.
Before enabling protection, confirm that your own country is allowed. Consider configuring trusted IP addresses and using the administrator safety protections provided by the plugin.
After making changes, test the website before logging out of WordPress or closing your administrator session.External Services
Country Access only interacts with external services where required for functionality that has been enabled.
Cloudflare
Cloudflare integration is optional and only begins when a WordPress administrator explicitly starts the authorization process.
When connected, Country Access may identify the website's zone and create, update, test, or remove its managed WAF rule.
Cloudflare OAuth credentials and relevant zone/account identifiers are stored within the WordPress installation so Country Access can manage its protection rule.
Cloudflare Privacy Policy →Deerwood Media OAuth Relay
Country Access uses an OAuth relay operated by Deerwood Media to simplify Cloudflare authorization.
The relay handles the OAuth/PKCE authorization transaction and returns the administrator to the originating WordPress website.
It may receive the WordPress return URL, website hostname, OAuth state information, and PKCE authorization data needed to complete the transaction.
Deerwood Media does not require the website owner to provide their Cloudflare password.
auth.deerwoodmedia.com →IPWhois / ipwho.is
Country Access includes an optional IP-based geolocation fallback. This feature is disabled by default.
If enabled and Cloudflare does not provide a usable country code, the visitor's IP address may be sent to IPWhois to determine the visitor's country.
Country lookup results are cached locally to reduce repeated external requests.
IPWhois →Privacy
When security logging is enabled, Country Access may store information about blocked requests in the local WordPress database, including visitor IP addresses, country codes, request paths, detection methods, and the reason a request was blocked.
Exact IP addresses may be required for repeat-offender detection, rate limiting, trusted IP handling, and optional Cloudflare edge blocking.
Detailed local logs are automatically removed according to the retention period configured by the website administrator.
Frequently Asked Questions
Do I need Cloudflare?
Does protection turn on immediately after installing the plugin?
What countries are selected by default?
Can Country Access block me from my own website?
Does Country Access create lots of Cloudflare firewall rules?
What happens if my Cloudflare account has reached its custom rule limit?
Will it block Google?
Does Country Access trust the Googlebot User-Agent?
Why are there fewer blocked requests in WordPress after enabling Cloudflare?
Does the plugin send security data to Deerwood Media?
Is this a replacement for Wordfence or another full security suite?
Is Deerwood Country Access free?
Start Protecting Your WordPress Website
Download Deerwood Country Access and take control of geographic access, abusive traffic, and repeat offenders.
Download Deerwood Country AccessDisclaimer
Deerwood Country Access is provided without warranty to the extent permitted by applicable law. Website administrators are responsible for reviewing and testing their access rules, Cloudflare configuration, trusted IP settings, backups, and recovery procedures.
Deerwood Media and contributors are not responsible for website downtime, blocked legitimate traffic, lost traffic, lost revenue, data loss, third-party service behavior, configuration errors, or other damages resulting from the installation, configuration, use, or inability to use the plugin.