Block Rules

Documentation · IP & Fake Order Blocker

The Block & Re-director engine decides, for every storefront visitor, whether to let them through, block them, or send them to a different URL. Rules live under Block & Re-director in the app.

Rule types

IP address — a single IP (e.g. 203.0.113.4) or a CIDR range (e.g. 203.0.113.0/24).
IP prefix — a “starts with” match, e.g. 203.0.113 matches any address beginning with that prefix.
Country — block, allow, or redirect an entire country. A country rule can also use the wildcard value * to mean “every country”, which is how you build a “block everyone except” list (see below).
Province / state — scoped to a specific province inside a country, or a province wildcard (“every province in this country except the ones I’ve allowed”).

Actions

Block — the visitor is stopped from viewing the storefront.
Allow — explicitly lets a visitor through, even inside an otherwise-blocked country or range.
Redirect — sends the visitor to a URL you choose instead of blocking them outright.

How conflicting rules are resolved

A visitor can match more than one rule at once — an IP rule, a country rule, and a province rule can all apply to the same request. The engine checks them in a fixed order, most specific first:

Disabled rules never participate in matching, regardless of type.
Exact IP / CIDR rules. If more than one CIDR matches, the most specific (smallest) range wins.
IP-prefix rules. The longest matching prefix wins.
Tor exit-node check (Enterprise, only if Tor blocking is turned on) — checked before country/province rules, so a Tor exit node is caught regardless of what country it claims to be in. A merchant’s own IP-level rule (steps 2–3) still takes priority over this.
An exact province match, then a province wildcard (“every province in this country except…”).
An exact country match.
A country wildcard (“every country except…”). Countries you’ve explicitly allowed are checked before the wildcard applies, so “allow” exceptions always win over a broad “block everyone” rule.
If two rules at the same tier are still tied, block wins over redirect, which wins over allow; remaining ties are broken by the rule’s priority, then by which was created first.

If nothing matches at all — or the app can’t evaluate a request for any reason — the visitor is allowed through. The app is built to fail open: a problem evaluating rules should never be able to take your storefront offline for everyone.

Blocking all except a specific list

To block an entire country and only allow a handful of exceptions, create one country rule with action block and value *, then add individual allow rules for each country you want to let through. Allow rules are always checked before the wildcard, so your exceptions apply correctly. The same pattern works for provinces within a single country.

Rule limits

Each plan allows a maximum number of active block rules (see Plans & Billing for the exact numbers). If you go over your plan’s limit — for example after downgrading — the rules beyond the limit are never deleted. They’re shown greyed out in the list and simply don’t take part in matching until you’re back within your limit or upgrade.

Tor exit-node blocking (Enterprise)

Enterprise plans can turn on a separate toggle that blocks traffic from known Tor exit nodes, using a regularly refreshed list of exit-node IPs. It only recognizes plain IPv4 exit nodes and runs as its own check in the precedence order above.