WordPress.org
Get WordPress

Plugin Directory

Changeset 3783922


Ignore:
Timestamp:
11/04/2026 12:28:03 PM (6 hours ago)
Author:
huloglobal
Message:

Readme update for 0.1.1

Location:
hulo-geo-block
Files:
5 added
2 edited

Legend:

Unmodified
Added
Removed

  • hulo-geo-block/tags/0.1.1/readme.txt

    r3782915 r3783922  
    1717HULO Geo-block decides, before WordPress runs its main query, whether a visitor may use your site. Allowed visitors are untouched; refused visitors see a branded block page or are redirected.
    1818
    19 Works on any WordPress site. With WooCommerce it also refuses add-to-cart and checkout (classic checkout and the Checkout block) for blocked visitors, uses WooCommerce's MaxMind geolocation, and with HULO Payments it refuses payments from blocked visitors.
     19Works on any WordPress site. If you take payments with the free [HULO Payments](https://huloglobal.com/wordpress-plugins/payments/) plugin, payments from blocked visitors are refused before they are charged.
    2020
    2121**Rules**
    … …  
    2727**Never locks you out**
    2828
    29 * Administrators (and, with WooCommerce, shop managers) are never blocked.
     29* Administrators are never blocked.
    3030* wp-admin, the login page, cron, AJAX, the REST API, XML-RPC, payment-gateway callbacks (`wc-api`), robots.txt and sitemaps are never blocked.
    3131* IP allowlist with IPv4 and IPv6 addresses and CIDR ranges, plus a one-click "Add my IP".
    … …  
    3333**SEO-safe**
    3434
    35 * Well-known search and link-preview crawlers (Googlebot, Bingbot, DuckDuckBot, Applebot, Facebook, LinkedIn, Slack, WhatsApp and more) are let through by default, so a country restriction does not drop your store out of search results. Permissive, custom and off modes are available.
     35* Well-known search and link-preview crawlers (Googlebot, Bingbot, DuckDuckBot, Applebot, Facebook, LinkedIn, Slack, WhatsApp and more) are let through by default, so a country restriction does not drop your site out of search results. Permissive, custom and off modes are available.
    3636* Crawlers may only browse. A User-Agent can be faked, so add-to-cart, checkout and payments are never exempt.
    3737* Optional reverse-DNS verification of Googlebot and Bingbot: a visitor claiming to be one is checked against googlebot.com / search.msn.com before it is let through.
    … …  
    4747* Cloudflare `CF-IPCountry` (and `cf-region-code`), Akamai and Fastly country headers, once you tell the plugin the site is behind that CDN. Any visitor can send these headers, so they are honoured only for requests arriving from a trusted proxy: Cloudflare's published ranges (one tick) or the addresses you list (or the `HULO_TRUSTED_PROXIES` constant).
    4848* Web-server GeoIP modules (`GEOIP_COUNTRY_CODE`, `MM_COUNTRY_CODE`).
    49 * With WooCommerce: its own geolocation, including its MaxMind database integration.
    5049* This plugin never calls a geolocation API. If no source is available yet, the settings page says so and visitors with an unknown country are allowed.
    51 * A full country list ships with the plugin; with WooCommerce its translated list is used.
     50* A full country list ships with the plugin.
    5251* Proxy-aware visitor IP: by default only the connecting address is used. Forwarding headers you tick are read only from trusted proxies, and for `X-Forwarded-For` the right-most address that is not one of your proxies is taken.
    53 
    54 **WooCommerce and HULO Payments (optional)**
    55 
    56 * With WooCommerce active, add-to-cart, the classic checkout and the Checkout block (Store API) refuse blocked visitors on the server, whatever a page cache served.
    57 * With HULO Payments active, payments from blocked visitors are refused before they are charged.
    5852
    5953**Cache-safe**
    … …  
    6660* `GET /wp-json/hulo-geo-block/v1/check` returns the current visitor's verdict (rate-limited, uncached). A server-side caller can pass the visitor's country signed with a secret.
    6761
     62= With WooCommerce =
     63
     64Geo-block also:
     65
     66* refuses add-to-cart, the classic checkout and the Checkout block (Store API) for blocked visitors, on the server, whatever a page cache served;
     67* never blocks shop managers;
     68* can use the shop's geolocation, including its MaxMind database integration, as a country source;
     69* uses the shop's translated country names.
     70
    6871= Geo-block Pro =
    6972
    … …  
    7376
    74771. Install HULO Geo-block from Plugins → Add New, or upload the zip, and activate it.
    75 2. Go to HULO → Geo-block. If the page says no country source was found, put the site behind a CDN that sends the visitor's country (for example Cloudflare), enable a GeoIP module in your web server, or, with WooCommerce, add a MaxMind licence key in WooCommerce → Settings → Integration.
     782. Go to HULO → Geo-block. If the page says no country source was found, put the site behind a CDN that sends the visitor's country (for example Cloudflare) and set it up on the Settings tab (country headers and trusted proxies), or enable a GeoIP module in your web server. On a WooCommerce shop you can instead add a MaxMind licence key in its Integration settings.
    76793. On the Rules tab pick the regions or countries you serve, tick "Apply the country rules to visitors" and save.
    7780
    … …  
    8083= Can I lock myself out? =
    8184
    82 No. Administrators (and shop managers when WooCommerce is active) are never blocked, wp-admin and the login page are never blocked, and the plugin will not switch on rules that would allow no one.
     85No. Administrators are never blocked, wp-admin and the login page are never blocked, and the plugin will not switch on rules that would allow no one.
    8386
    8487= Do I need WooCommerce? =
    8588
    86 No. Geo-block works on any WordPress site. WooCommerce adds checkout protection and its MaxMind geolocation.
     89No. Geo-block works on any WordPress site. If you do run it, Geo-block also guards add-to-cart and checkout and can use the shop's MaxMind geolocation.
    8790
    8891= What happens when a visitor's country is unknown? =
    8992
    90 They are allowed. Set up a country source (CDN headers, a web-server GeoIP module, or WooCommerce's MaxMind integration) so countries are known.
     93They are allowed; allowlists, business hours and maintenance still work. Set up a country source (see Installation, step 2) so countries are known.
    9194
    9295= Does it work with page caching? =
    9396
    94 Yes. Block pages are never cached. If your cache serves HTML without running WordPress, turn on the page-cache helper on the Settings tab. With WooCommerce, checkout always re-checks on the server.
     97Yes. Block pages are never cached. If your cache serves HTML without running WordPress, turn on the page-cache helper on the Settings tab. Checkout and payments always re-check the visitor on the server.
    9598
    96 = Will Google still index my store? =
     99= Will Google still index my site? =
    97100
    98101Yes, by default search and link-preview crawlers are let through.
    … …  
    108111== Screenshots ==
    109112
    110 1. HULO → Geo-block, Rules tab with region presets and the live summary.
    111 2. The branded block page.
    112 3. Business hours and maintenance window.
    113 4. Settings: country sources, visitor IP headers and crawler exceptions.
     1131. HULO → Geo-block, Rules tab: region presets that stack, the plain-English summary of what the rules do, and the dismissible Pro box.
     1142. The branded block page a visitor from a country you don't serve sees, with your logo, message and support e-mail.
     1153. IP allowlist: IPv4 and IPv6 addresses and CIDR ranges that bypass every rule, and "Add my IP".
     1164. Hours & maintenance: open days and hours in your time zone with a closed message, and a one-off maintenance window with the IPs that may still visit.
     1175. Settings: country sources, trusted proxies (one tick for Cloudflare), the visitor IP header and crawler exceptions, with a check of your own request at the top.
    114118
    115119== External services ==
    116120
    117 This plugin does not connect to any external service. Country lookups use request headers set by your CDN or web server, or, when WooCommerce is active, WooCommerce's own geolocation.
     121This plugin does not connect to any external service. Country lookups use request headers set by your CDN or web server or, when WooCommerce is active, its own geolocation. Its MaxMind integration, if you turn it on, downloads the GeoLite2 database from MaxMind itself, under MaxMind's terms; this plugin never does.
    118122
    119 If you turn on "Verify Googlebot and Bingbot by reverse DNS" (off by default), a visitor whose User-Agent claims to be Googlebot or Bingbot has their IP address looked up in DNS (a reverse lookup, then a forward lookup of the returned host name) through your server's own DNS resolver. The answer is cached for a day. Only the visitor's IP address is involved; no data is sent to Google, Microsoft or HULO. If you enable WooCommerce's MaxMind integration, WooCommerce itself downloads the GeoLite2 database from MaxMind under MaxMind's terms; that is part of WooCommerce, not this plugin.
     123If you turn on "Verify Googlebot and Bingbot by reverse DNS" (off by default), a visitor whose User-Agent claims to be Googlebot or Bingbot has their IP address looked up in DNS (a reverse lookup, then a forward lookup of the returned host name) through your server's own DNS resolver. The answer is cached for a day. Only the visitor's IP address is involved; no data is sent to Google, Microsoft or HULO.
    120124
    121125== Changelog ==
    122126
    123127= 0.1.1 =
    124 * Security: crawler User-Agents may browse but never buy or pay; CDN country and IP headers are honoured only from trusted proxies (off by default); REST and WooCommerce endpoint exemptions follow what WordPress actually routed; optional reverse-DNS verification of Googlebot and Bingbot.
     128* Security: crawler User-Agents may browse but never buy or pay; CDN country and IP headers are honoured only from trusted proxies (off by default); REST, `wc-api` and `wc-ajax` exemptions follow what WordPress actually routed; optional reverse-DNS verification of Googlebot and Bingbot.
    125129* The block page's styles are registered and printed through WordPress, and settings forms read and sanitise each declared field.
    126130
    127131= 0.1.0 =
    128132* First release for any WordPress site: country and region-preset rules, always-blocked countries, IP allowlist (IPv4/IPv6 CIDR), crawler allowlist, branded block page or redirect, business hours, maintenance window, CDN/web-server geolocation, bundled country list, page-cache helper, headless check endpoint and extension hooks.
    129 * With WooCommerce: checkout and add-to-cart guards (classic and Checkout block) and WooCommerce/MaxMind geolocation. With HULO Payments: payments from blocked visitors are refused.
     133* With HULO Payments: payments from blocked visitors are refused. With WooCommerce: add-to-cart and checkout guards (classic and Checkout block) and its MaxMind geolocation.

  • hulo-geo-block/trunk/readme.txt

    r3782915 r3783922  
    1717HULO Geo-block decides, before WordPress runs its main query, whether a visitor may use your site. Allowed visitors are untouched; refused visitors see a branded block page or are redirected.
    1818
    19 Works on any WordPress site. With WooCommerce it also refuses add-to-cart and checkout (classic checkout and the Checkout block) for blocked visitors, uses WooCommerce's MaxMind geolocation, and with HULO Payments it refuses payments from blocked visitors.
     19Works on any WordPress site. If you take payments with the free [HULO Payments](https://huloglobal.com/wordpress-plugins/payments/) plugin, payments from blocked visitors are refused before they are charged.
    2020
    2121**Rules**
    … …  
    2727**Never locks you out**
    2828
    29 * Administrators (and, with WooCommerce, shop managers) are never blocked.
     29* Administrators are never blocked.
    3030* wp-admin, the login page, cron, AJAX, the REST API, XML-RPC, payment-gateway callbacks (`wc-api`), robots.txt and sitemaps are never blocked.
    3131* IP allowlist with IPv4 and IPv6 addresses and CIDR ranges, plus a one-click "Add my IP".
    … …  
    3333**SEO-safe**
    3434
    35 * Well-known search and link-preview crawlers (Googlebot, Bingbot, DuckDuckBot, Applebot, Facebook, LinkedIn, Slack, WhatsApp and more) are let through by default, so a country restriction does not drop your store out of search results. Permissive, custom and off modes are available.
     35* Well-known search and link-preview crawlers (Googlebot, Bingbot, DuckDuckBot, Applebot, Facebook, LinkedIn, Slack, WhatsApp and more) are let through by default, so a country restriction does not drop your site out of search results. Permissive, custom and off modes are available.
    3636* Crawlers may only browse. A User-Agent can be faked, so add-to-cart, checkout and payments are never exempt.
    3737* Optional reverse-DNS verification of Googlebot and Bingbot: a visitor claiming to be one is checked against googlebot.com / search.msn.com before it is let through.
    … …  
    4747* Cloudflare `CF-IPCountry` (and `cf-region-code`), Akamai and Fastly country headers, once you tell the plugin the site is behind that CDN. Any visitor can send these headers, so they are honoured only for requests arriving from a trusted proxy: Cloudflare's published ranges (one tick) or the addresses you list (or the `HULO_TRUSTED_PROXIES` constant).
    4848* Web-server GeoIP modules (`GEOIP_COUNTRY_CODE`, `MM_COUNTRY_CODE`).
    49 * With WooCommerce: its own geolocation, including its MaxMind database integration.
    5049* This plugin never calls a geolocation API. If no source is available yet, the settings page says so and visitors with an unknown country are allowed.
    51 * A full country list ships with the plugin; with WooCommerce its translated list is used.
     50* A full country list ships with the plugin.
    5251* Proxy-aware visitor IP: by default only the connecting address is used. Forwarding headers you tick are read only from trusted proxies, and for `X-Forwarded-For` the right-most address that is not one of your proxies is taken.
    53 
    54 **WooCommerce and HULO Payments (optional)**
    55 
    56 * With WooCommerce active, add-to-cart, the classic checkout and the Checkout block (Store API) refuse blocked visitors on the server, whatever a page cache served.
    57 * With HULO Payments active, payments from blocked visitors are refused before they are charged.
    5852
    5953**Cache-safe**
    … …  
    6660* `GET /wp-json/hulo-geo-block/v1/check` returns the current visitor's verdict (rate-limited, uncached). A server-side caller can pass the visitor's country signed with a secret.
    6761
     62= With WooCommerce =
     63
     64Geo-block also:
     65
     66* refuses add-to-cart, the classic checkout and the Checkout block (Store API) for blocked visitors, on the server, whatever a page cache served;
     67* never blocks shop managers;
     68* can use the shop's geolocation, including its MaxMind database integration, as a country source;
     69* uses the shop's translated country names.
     70
    6871= Geo-block Pro =
    6972
    … …  
    7376
    74771. Install HULO Geo-block from Plugins → Add New, or upload the zip, and activate it.
    75 2. Go to HULO → Geo-block. If the page says no country source was found, put the site behind a CDN that sends the visitor's country (for example Cloudflare), enable a GeoIP module in your web server, or, with WooCommerce, add a MaxMind licence key in WooCommerce → Settings → Integration.
     782. Go to HULO → Geo-block. If the page says no country source was found, put the site behind a CDN that sends the visitor's country (for example Cloudflare) and set it up on the Settings tab (country headers and trusted proxies), or enable a GeoIP module in your web server. On a WooCommerce shop you can instead add a MaxMind licence key in its Integration settings.
    76793. On the Rules tab pick the regions or countries you serve, tick "Apply the country rules to visitors" and save.
    7780
    … …  
    8083= Can I lock myself out? =
    8184
    82 No. Administrators (and shop managers when WooCommerce is active) are never blocked, wp-admin and the login page are never blocked, and the plugin will not switch on rules that would allow no one.
     85No. Administrators are never blocked, wp-admin and the login page are never blocked, and the plugin will not switch on rules that would allow no one.
    8386
    8487= Do I need WooCommerce? =
    8588
    86 No. Geo-block works on any WordPress site. WooCommerce adds checkout protection and its MaxMind geolocation.
     89No. Geo-block works on any WordPress site. If you do run it, Geo-block also guards add-to-cart and checkout and can use the shop's MaxMind geolocation.
    8790
    8891= What happens when a visitor's country is unknown? =
    8992
    90 They are allowed. Set up a country source (CDN headers, a web-server GeoIP module, or WooCommerce's MaxMind integration) so countries are known.
     93They are allowed; allowlists, business hours and maintenance still work. Set up a country source (see Installation, step 2) so countries are known.
    9194
    9295= Does it work with page caching? =
    9396
    94 Yes. Block pages are never cached. If your cache serves HTML without running WordPress, turn on the page-cache helper on the Settings tab. With WooCommerce, checkout always re-checks on the server.
     97Yes. Block pages are never cached. If your cache serves HTML without running WordPress, turn on the page-cache helper on the Settings tab. Checkout and payments always re-check the visitor on the server.
    9598
    96 = Will Google still index my store? =
     99= Will Google still index my site? =
    97100
    98101Yes, by default search and link-preview crawlers are let through.
    … …  
    108111== Screenshots ==
    109112
    110 1. HULO → Geo-block, Rules tab with region presets and the live summary.
    111 2. The branded block page.
    112 3. Business hours and maintenance window.
    113 4. Settings: country sources, visitor IP headers and crawler exceptions.
     1131. HULO → Geo-block, Rules tab: region presets that stack, the plain-English summary of what the rules do, and the dismissible Pro box.
     1142. The branded block page a visitor from a country you don't serve sees, with your logo, message and support e-mail.
     1153. IP allowlist: IPv4 and IPv6 addresses and CIDR ranges that bypass every rule, and "Add my IP".
     1164. Hours & maintenance: open days and hours in your time zone with a closed message, and a one-off maintenance window with the IPs that may still visit.
     1175. Settings: country sources, trusted proxies (one tick for Cloudflare), the visitor IP header and crawler exceptions, with a check of your own request at the top.
    114118
    115119== External services ==
    116120
    117 This plugin does not connect to any external service. Country lookups use request headers set by your CDN or web server, or, when WooCommerce is active, WooCommerce's own geolocation.
     121This plugin does not connect to any external service. Country lookups use request headers set by your CDN or web server or, when WooCommerce is active, its own geolocation. Its MaxMind integration, if you turn it on, downloads the GeoLite2 database from MaxMind itself, under MaxMind's terms; this plugin never does.
    118122
    119 If you turn on "Verify Googlebot and Bingbot by reverse DNS" (off by default), a visitor whose User-Agent claims to be Googlebot or Bingbot has their IP address looked up in DNS (a reverse lookup, then a forward lookup of the returned host name) through your server's own DNS resolver. The answer is cached for a day. Only the visitor's IP address is involved; no data is sent to Google, Microsoft or HULO. If you enable WooCommerce's MaxMind integration, WooCommerce itself downloads the GeoLite2 database from MaxMind under MaxMind's terms; that is part of WooCommerce, not this plugin.
     123If you turn on "Verify Googlebot and Bingbot by reverse DNS" (off by default), a visitor whose User-Agent claims to be Googlebot or Bingbot has their IP address looked up in DNS (a reverse lookup, then a forward lookup of the returned host name) through your server's own DNS resolver. The answer is cached for a day. Only the visitor's IP address is involved; no data is sent to Google, Microsoft or HULO.
    120124
    121125== Changelog ==
    122126
    123127= 0.1.1 =
    124 * Security: crawler User-Agents may browse but never buy or pay; CDN country and IP headers are honoured only from trusted proxies (off by default); REST and WooCommerce endpoint exemptions follow what WordPress actually routed; optional reverse-DNS verification of Googlebot and Bingbot.
     128* Security: crawler User-Agents may browse but never buy or pay; CDN country and IP headers are honoured only from trusted proxies (off by default); REST, `wc-api` and `wc-ajax` exemptions follow what WordPress actually routed; optional reverse-DNS verification of Googlebot and Bingbot.
    125129* The block page's styles are registered and printed through WordPress, and settings forms read and sanitise each declared field.
    126130
    127131= 0.1.0 =
    128132* First release for any WordPress site: country and region-preset rules, always-blocked countries, IP allowlist (IPv4/IPv6 CIDR), crawler allowlist, branded block page or redirect, business hours, maintenance window, CDN/web-server geolocation, bundled country list, page-cache helper, headless check endpoint and extension hooks.
    129 * With WooCommerce: checkout and add-to-cart guards (classic and Checkout block) and WooCommerce/MaxMind geolocation. With HULO Payments: payments from blocked visitors are refused.
     133* With HULO Payments: payments from blocked visitors are refused. With WooCommerce: add-to-cart and checkout guards (classic and Checkout block) and its MaxMind geolocation.
Note: See TracChangeset for help on using the changeset viewer.