PBJ Geo Viewer Changelog (v1.5.0): Five Guided Steps to Country Blocking

PBJ Geo Viewer makes a WordPress site view-only for visitors outside the countries you allow. Everyone can still browse every page — great for SEO, since crawlers always see the full site — but visitors from non-allowed regions can’t purchase, submit forms, comment, or register. Here’s the full release history.

Version 1.5.0 — Settings becomes a five-step walkthrough

Geo-blocking has real footguns — lock the wrong country and you lock out your customers; misread “unknown country” and you block your own CDN. 1.5.0 reworks the Settings tab into a guided five-step walkthrough, each step in its own numbered card with a plain-English “what this does” explanation:

• Step 1 — mode and countries: allowlist vs blocklist, what “unknown country” means for you, plus the optional IP blacklist.
• Step 2 — what view-only visitors can’t do: purchases, forms, comments, registration — while pages still render fully, so SEO is never at risk.
• Step 3 — what blocked visitors see: banner vs inline message, and where each appears.
• Step 4 — exemptions: IP allowlist (full-site exemption) vs username allowlist (sign-in only), and the geo cache.
• Step 5 — test your setup: the diagnostics panel, how to read it, and how to test with a spoofed CF-IPCountry header or the X-PBJ-Geo response header.

Still one form with one Save button — every setting name, saved value, and all enforcement behaviour are identical to 1.4.0.

Version 1.4.0 — license keys arrive

A License section was added to PBJ Geo Viewer’s settings. Enter the PBJ license key from your purchase and the plugin unlocks automatic updates straight from pbj.tech, delivered through the normal WordPress updates screen. The plugin is fully functional without a key — a key only gates updates, never features — and one key covers up to 3 sites.

Version 1.3.1 — country picker layout fix

The country checkbox list used CSS columns, which forced a horizontal scrollbar inside a fixed-height box — awkward on some Windows browsers. It is now a responsive grid that reflows to the panel width and only ever scrolls vertically.

Version 1.3.0

• Moved to its own top-level Geo Viewer sidebar item (was under Settings).
• Country selection is now a filterable checkbox grid with Select-all-shown / Clear-all and a live count, replacing the old ctrl-click list.
• New: wildcard IP blacklist. Block visitors by exact IP, CIDR range, or wildcard (203.0.113.*, 10.*.*.*, 2001:db8:*) regardless of country. Crawlers and signed-in admins stay exempt.

Version 1.2.0

• Built-in User Guide — a new tab on Settings → Geo Viewer with the full guide: how requests are decided, every setting, recipes, verification, troubleshooting, and a quick reference. Also linked from the Plugins list row.

Version 1.1.0

• Fixed the traveling-admin lockout. The login page is no longer blocked outright; sign-ins are gated at the authenticate filter instead. Administrators and editors can always sign in from blocked regions, plus anyone on the new “Login username allowlist” setting. Registration remains fully blocked.
• Fixed a cache-poisoning edge: blocked-region page variants (banner, blocking CSS, disabled buttons) can no longer be stored by page/edge caches. Previously a blocked-region visitor could prime a public cache and every visitor worldwide got the view-only page until the cache expired.
• Fixed: crawler requests no longer trigger ip-api.com lookups — bot/admin status resolves before any country lookup.
• Added a pbj_geo_viewer_trust_proxy_headers filter for hosts not behind Cloudflare (where geo headers are spoofable), and a filter to disable the X-PBJ-Geo diagnostic header.
• Cleanup: uninstall removes all plugin data; dead code and sslverify => false removed.

Version 1.0.5

• Fixed: form submissions from blocked regions could still leak through plugins posting to admin-post.php with an action not on the hardcoded allowlist. The POST interceptor now blocks by endpoint — every action on admin-post.php, wp-comments-post.php, and the signup/registration endpoints is covered automatically. admin-ajax.php keeps a narrow action allowlist since it carries site features like search and lazy-load.
• Added: blocked responses now pick JSON vs HTML intelligently, so non-AJAX form POSTs get a readable 451 page instead of raw JSON.

Version 1.0.4

• Fixed: WooCommerce My Account / checkout registration and REST API user creation (POST /wp/v2/users) were not blocked; both now are, along with WP core’s wp-login.php?action=register, multisite signup, and BuddyPress/bbPress signups.
• Added: an X-PBJ-Geo diagnostic header on every front-end and REST response — check DevTools → Network to see the plugin’s decision per request.
• Changed: unknown-country behavior is now fail-closed in both allowlist and blocklist modes, with a new fail_open_on_unknown setting to opt back out.

Version 1.0.3

• Fixed: form submissions from blocked regions were leaking through. Form/comment/login filters now register on init instead of wp, so they fire on REST API and admin-ajax requests too — not just full front-end page loads.
• Added: a REST gate returning HTTP 451 for known form-plugin routes (Contact Form 7, WPForms, Gravity Forms, Ninja Forms, Fluent Forms, Formidable, native comments, PBJ Form Builder), plus detection of non-AJAX Gravity Forms and classic Contact Form 7 POSTs, and integrations for the Formidable and Fluent Forms validation pipelines.

Version 1.0.2

• Fixed the WordPress 6.7+ _load_textdomain_just_in_time notice on activation by moving translation loading to the init action.

Version 1.0.1

• Added an Update URI header so the plugin is never auto-replaced by a same-slug WordPress.org plugin, settings schema versioning with idempotent migrations, and a self-hosted updater for auto-updates from your own server.

Version 1.0.0

• Initial release: allowlist/blocklist country modes, Cloudflare CF-IPCountry and reverse-proxy header detection with an ip-api.com fallback, WooCommerce purchase blocking, form/comment/login/registration blocking, and always-on exemptions for search engines and admins.