PBJ Geo Viewer Changelog (v1.5.0): Five Guided Steps to Country Blocking

PBJ Geo Viewer makes a WordPress site view-only for visitors outside the countries you allow. Everyone can still browse every page — great for SEO, since crawlers always see the full site — but visitors from non-allowed regions can’t purchase, submit forms, comment, or register. Here’s the full release history.

Version 1.5.0 — Settings becomes a five-step walkthrough

Geo-blocking has real footguns — lock the wrong country and you lock out your customers; misread “unknown country” and you block your own CDN. 1.5.0 reworks the Settings tab into a guided five-step walkthrough, each step in its own numbered card with a plain-English “what this does” explanation:

• Step 1 — mode and countries: allowlist vs blocklist, what “unknown country” means for you, plus the optional IP blacklist.
• Step 2 — what view-only visitors can’t do: purchases, forms, comments, registration — while pages still render fully, so SEO is never at risk.
• Step 3 — what blocked visitors see: banner vs inline message, and where each appears.
• Step 4 — exemptions: IP allowlist (full-site exemption) vs username allowlist (sign-in only), and the geo cache.
• Step 5 — test your setup: the diagnostics panel, how to read it, and how to test with a spoofed CF-IPCountry header or the X-PBJ-Geo response header.

Still one form with one Save button — every setting name, saved value, and all enforcement behaviour are identical to 1.4.0.

Version 1.7.0

PBJ SEO & Security can now hand blocks straight to this plugin. From version 4.5.0, the security log in PBJ SEO shows the country beside each firewall block and failed sign-in, and puts a Block this IP and a Block RU (or whichever country it is) button on the row. Press one and it arrives here, in your settings, where you can see it and undo it exactly like something you typed yourself.

Why that needed a proper connection rather than one plugin quietly editing the other is worth knowing, because it is the sort of thing that silently does the opposite of what you asked. Your country list means allowed in allowlist mode and blocked in blocklist mode — so “block Russia” means adding it in one mode and removing it in the other. Anything that simply appended in both cases would have switched your protection off for that country while reporting success. The connection knows the difference: callers say what they want, and this plugin decides how.

It also refuses one thing outright. If you are in allowlist mode and the country being blocked is the last one still allowed, it says no. Emptying that list makes the entire world view-only — you included — and an empty box looks like one nobody has filled in yet rather than a setting that has just shut the site.

Small related fix: address lookups now skip the ranges reserved for documentation and testing. Asked about one of those, the lookup service confidently returns a country, which is not information — it is noise shaped like an answer, and sooner or later somebody acts on it.

Version 1.6.0

A lookup outage no longer keeps allowed visitors waiting fifteen minutes. When the country-lookup service was briefly unreachable or had hit its free limit, that failure was remembered for the full cache window — so a two-second hiccup could leave visitors from countries you allow treated as unknown, and therefore blocked, for a quarter of an hour. A real answer is still cached normally; a failure is now forgotten after about two minutes. An unknown country still fails closed, exactly as before.

The bundled licence-update client was also refreshed, so it reports its own version and warns when an older copy has loaded first on a site running several PBJ plugins.

Version 1.4.0 — license keys arrive

A License section was added to PBJ Geo Viewer’s settings. Enter the PBJ license key from your purchase and the plugin unlocks automatic updates straight from pbj.tech, delivered through the normal WordPress updates screen. The plugin is fully functional without a key — a key only gates updates, never features — and one key covers up to 3 sites.

Version 1.3.1 — country picker layout fix

The country checkbox list used CSS columns, which forced a horizontal scrollbar inside a fixed-height box — awkward on some Windows browsers. It is now a responsive grid that reflows to the panel width and only ever scrolls vertically.

Version 1.3.0

• Moved to its own top-level Geo Viewer sidebar item (was under Settings).
• Country selection is now a filterable checkbox grid with Select-all-shown / Clear-all and a live count, replacing the old ctrl-click list.
• New: wildcard IP blacklist. Block visitors by exact IP, CIDR range, or wildcard (203.0.113.*, 10.*.*.*, 2001:db8:*) regardless of country. Crawlers and signed-in admins stay exempt.

Version 1.2.0

• Built-in User Guide — a new tab on Settings → Geo Viewer with the full guide: how requests are decided, every setting, recipes, verification, troubleshooting, and a quick reference. Also linked from the Plugins list row.

Version 1.1.0

• Fixed the traveling-admin lockout. The login page is no longer blocked outright; sign-ins are gated at the authenticate filter instead. Administrators and editors can always sign in from blocked regions, plus anyone on the new “Login username allowlist” setting. Registration remains fully blocked.
• Fixed a cache-poisoning edge: blocked-region page variants (banner, blocking CSS, disabled buttons) can no longer be stored by page/edge caches. Previously a blocked-region visitor could prime a public cache and every visitor worldwide got the view-only page until the cache expired.
• Fixed: crawler requests no longer trigger ip-api.com lookups — bot/admin status resolves before any country lookup.
• Added a pbj_geo_viewer_trust_proxy_headers filter for hosts not behind Cloudflare (where geo headers are spoofable), and a filter to disable the X-PBJ-Geo diagnostic header.
• Cleanup: uninstall removes all plugin data; dead code and sslverify => false removed.

Version 1.0.5

• Fixed: form submissions from blocked regions could still leak through plugins posting to admin-post.php with an action not on the hardcoded allowlist. The POST interceptor now blocks by endpoint — every action on admin-post.php, wp-comments-post.php, and the signup/registration endpoints is covered automatically. admin-ajax.php keeps a narrow action allowlist since it carries site features like search and lazy-load.
• Added: blocked responses now pick JSON vs HTML intelligently, so non-AJAX form POSTs get a readable 451 page instead of raw JSON.

Version 1.0.4

• Fixed: WooCommerce My Account / checkout registration and REST API user creation (POST /wp/v2/users) were not blocked; both now are, along with WP core’s wp-login.php?action=register, multisite signup, and BuddyPress/bbPress signups.
• Added: an X-PBJ-Geo diagnostic header on every front-end and REST response — check DevTools → Network to see the plugin’s decision per request.
• Changed: unknown-country behavior is now fail-closed in both allowlist and blocklist modes, with a new fail_open_on_unknown setting to opt back out.

Version 1.0.3

• Fixed: form submissions from blocked regions were leaking through. Form/comment/login filters now register on init instead of wp, so they fire on REST API and admin-ajax requests too — not just full front-end page loads.
• Added: a REST gate returning HTTP 451 for known form-plugin routes (Contact Form 7, WPForms, Gravity Forms, Ninja Forms, Fluent Forms, Formidable, native comments, PBJ Form Builder), plus detection of non-AJAX Gravity Forms and classic Contact Form 7 POSTs, and integrations for the Formidable and Fluent Forms validation pipelines.

Version 1.0.2

• Fixed the WordPress 6.7+ _load_textdomain_just_in_time notice on activation by moving translation loading to the init action.

Version 1.0.1

• Added an Update URI header so the plugin is never auto-replaced by a same-slug WordPress.org plugin, settings schema versioning with idempotent migrations, and a self-hosted updater for auto-updates from your own server.

Version 1.0.0

• Initial release: allowlist/blocklist country modes, Cloudflare CF-IPCountry and reverse-proxy header detection with an ip-api.com fallback, WooCommerce purchase blocking, form/comment/login/registration blocking, and always-on exemptions for search engines and admins.