Drupal GEO Website Protection is the security module that limits access to your website from unwanted countries and IP addresses. Control who can open your website and your Drupal administration based on geographic location.
The module restricts access to your Drupal website based on the country a visitor's IP address belongs to. Block whole countries on the public site, keep the administration and the login page closed to the countries your team never works from, or send visitors from a country to the right language version of your website.
Most attacks on Drupal websites target the login page. Closing the administration to countries you do not work from removes almost all brute force attempts. The check runs before Drupal builds the page, even before a cached page is served, so blocked traffic costs your server almost nothing.
Country lookups use a database stored on your own server. No visitor data is sent to any external service.
The country list now includes every country the GeoIP database knows, among them Serbia, Montenegro, Kosovo, Saint Martin and Sint Maarten. The United Kingdom now uses its correct code GB, so it is blocked when selected; settings saved with the old code UK are converted automatically after the update.
The statistics and the latest events on the module page now read the database in a way that works the same in Drupal 10.3, 11 and the coming Drupal 12, and Drupal 11 no longer logs a deprecation notice for it.
The SiteGuarding security agent (siteguarding_tools.php) is now added to the website root only when the module is installed and the site does not have it yet. An existing file is never replaced: the agent keeps itself up to date. The Settings tab offers "Install the agent" only while the agent is missing.
Version 1.0.0 is a new module for Drupal 10.3 and later and Drupal 11, with the same features and interface as the WordPress, Joomla, OpenCart and PrestaShop editions.
The module has separate switches for the public site and the administration, a country picker with search and continents, GEO redirects, IP rules with wildcards and CIDR ranges for IPv4 and IPv6, activity charts and a live preview of the block page. Forwarded headers such as X-Forwarded-For are read only from a trusted proxy, and websites behind Cloudflare work with no setup. The check runs before Drupal's page cache, settings.php is not changed, and your settings are kept when you update the module. Settings of the Drupal 8 version are imported automatically.
| Feature | Free Version | Full Version |
|---|---|---|
| Site protection by country | Up to 5 countries | Unlimited |
| Admin protection by country | Up to 5 countries | Unlimited |
| Block and allow lists by IP address, wildcard and CIDR range | ||
| Search engine crawler ranges in one click | ||
| GEO redirects by country | Up to 5 countries | Unlimited, with exceptions by IP address and URL |
| Never filter selected pages (payment callbacks, webhooks) | ||
| Activity log and charts | ||
| Custom block page with your logo and text | ||
| GEO database updates | By hand, once every 30 days | Automatic |
| Remove the SiteGuarding link on the front page | ||
| Support and help | Email only | Email and Live Chat |
Download the free version to get started with geographic access control, or get the full version for unlimited countries and IP lists.
The previous modules for Drupal 7 and Drupal 8 are still available. They do not run on Drupal 9, 10 or 11.
1. Unpack drupal-geo-website-protection.zip. It contains one folder, sggeoprotection.
2. Upload that folder to the modules folder of your Drupal website (on most websites web/modules/custom/ or modules/), so that you get modules/sggeoprotection/sggeoprotection.info.yml.
3. In the administration, open Extend, tick GEO Website Protection and click Install. With Drush: drush en sggeoprotection.
4. Open Configuration > System > GEO Website Protection.
Updating from an earlier version
Replace the sggeoprotection folder with the new one and run the database updates: open /update.php or run drush updatedb. Your settings and the activity log are kept.
Updating from the Drupal 8 version
Remove the old sggeoprotection folder, upload the new one and run the database updates. The settings of the Drupal 8 version are imported; IP rules are rewritten so they keep covering the same addresses, and the module page lists every rule it changed.
Requirements
Drupal 10.3 or newer, or Drupal 11, with PHP 8.1 or newer. The module keeps its settings in a folder named sggeo inside the private files folder, or inside sites/default/files when the website has no private files folder, and protects its settings from web access. The files folder must be writable for the web server, as Drupal itself requires.
