A Wall With a Gatekeeper, Not a Moat
In blocking international traffic for security, we made the case that a U.S.-focused business has little to gain and plenty to lose from letting the whole world hammer on its website. This post is the practical sequel: how we actually build that wall for clients, using Cloudflare, and why it has become one of our favorite tools for the job.
Cloudflare sits in front of your website as a reverse proxy. Point your domain's DNS at Cloudflare, and every visitor reaches Cloudflare's network first, where traffic can be inspected, challenged, cached, or blocked before your server ever hears about it. That position, in front of everything, is what makes it the right place to enforce a border.
Country Rules: The Great Wall Part
Cloudflare's firewall rules can match visitors by country and respond three ways, and choosing among them is most of the strategy:
- Block refuses the request outright. Right for countries that send you nothing but attack traffic.
- Challenge presents a verification page a human can pass and most bots cannot. Right for regions where a rare legitimate visitor might exist, like an American customer traveling abroad.
- Allow with logging, so you can watch a region before deciding.
Our usual pattern for a U.S.-only business: allow the United States cleanly, challenge most of the world, and block the handful of sources that fill the logs with brute-force attempts. The site stays reachable to real people everywhere while the automated noise dies at the wall.
What You Get Beyond the Wall
The same free-to-cheap service adds layers that complement the geo-rules: a web application firewall that recognizes attack patterns (a concept we unpacked in understanding firewalls), rate limiting for login pages, bot management, an Under Attack mode for the bad days, and a global CDN that caches your content closer to visitors, so the security wall actually makes the site faster for the people you want. Hiding your server's real IP address behind the proxy is its own quiet win: attackers cannot aim at what they cannot find.
The Fine Print, Honestly
- Determined attackers can rent U.S. IPs. The wall raises cost, it does not grant immunity. Application-level protection, like a properly configured WordPress firewall, still matters behind it.
- Do not wall out your own tools. Payment processors, monitoring services, and APIs sometimes call from abroad. Watch the logs before hard-blocking, and add exceptions deliberately.
- Google is fine. Googlebot crawls from U.S. addresses, so a country wall does not hurt a U.S. business's rankings. Blocking carelessly by ASN or bot score, however, can. This is why the rules deserve an hour of expertise instead of a checkbox.
Set Once, Watch Forever
The setup takes an afternoon: move DNS, set the rules, test from outside, and check the analytics a week later to see what the wall is catching. The ongoing part is the watching, because traffic patterns shift and rules drift out of date, which is why we fold this into managed hosting for our clients rather than treating it as a one-time trick.
If your logs are full of visitors your business could never serve, the wall is waiting and the price is right. Ask us to set it up properly, and we will show you a before-and-after from your own traffic.
