How to Block Countries in Bricksforge Forms?
Co-founder & Brand Designer
Reviewed by Onar Alili
Co-founder & Engineer
Published 10 min read
Bricksforge Pro Forms has no built-in country blocking. To block countries, use the oopspam Anti-Spam plugin to filter Pro Forms submissions by country, or use Cloudflare to block whole countries from your website. For most sites, form-level filtering is the better choice because your site stays open to everyone.
Bricksforge is an add-on for the Bricks site builder. Its Pro Forms element can create posts, register users, send webhooks and take payments. That makes every spam submission more expensive than a junk email. If most of your spam comes from countries you don’t serve, blocking those countries is a quick way to cut the noise.
This guide covers two methods:
- oopspam: blocks Pro Forms submissions from selected countries. Your site stays visible worldwide.
- Cloudflare: blocks visitors from selected countries before they reach your website.
Does Bricksforge Have Built-In Country Blocking?
No. Bricksforge Pro Forms can’t filter submissions by country or IP address.
The Pro Forms documentation lists these protection tools:
- reCAPTCHA v3, hCaptcha and Cloudflare Turnstile
- Honeypot fields
- Server-side validation rules (required fields, regex, file limits)
- Prevent Duplicates and Maximum Submissions in the Create Submission action
- Submit button conditions
None of these look at where a visitor is located. Submit button conditions can check form fields, post meta or submission limits, but not the visitor’s country. To block countries, you need a third-party tool. We cover all the built-in options in 7 Ways to Protect Your Bricksforge Forms from Spam.
Using the native Bricks Form element instead of Bricksforge Pro Forms? The steps are almost the same. See How to block countries in Bricks Forms.
Method 1: Block Countries in Bricksforge Forms with oopspam
oopspam Anti-Spam supports Bricksforge Pro Forms natively from plugin version 1.2.87. It checks each submission on the server before Bricksforge runs any action, so a blocked entry never creates a post, user or webhook call.
Country filtering works at the form level. Visitors from blocked countries can still read your site. They just can’t submit your forms.
What oopspam adds to Bricksforge Forms
- Country filtering: block or allow submissions from selected countries
- Trusted countries: let your core markets skip spam checks
- Language filtering: reject messages written in languages you don’t support
- VPN, proxy and Tor blocking: stop visitors who hide their real location
- Rate limiting: cap how often one IP or email can submit
- Machine learning spam detection: catch bot and human spam in the message content
- Logs: see every blocked entry and the reason it was blocked
How to set it up
Setup takes about five minutes. You don’t need to edit your forms in the Bricks builder.
Step 1: Install the oopspam plugin
In WordPress, go to Plugins > Add New, search for oopspam Anti-Spam, then install and activate it. You can also download it from the WordPress plugin directory. Make sure you run version 1.2.87 or later.
Step 2: Get your API key
Create a free oopspam account and copy your API key from the dashboard.
Step 3: Connect the API key
Go to Settings > oopspam Anti-Spam. Paste the key into My API Key and select oopspam Dashboard as the key source. Save your changes.
Step 4: Turn on Bricksforge Forms protection
Scroll to the Bricksforge Forms section and check Activate Spam Protection. This covers every Pro Form on your site. If you also use the native Bricks Form element, turn on the Bricks Forms section too.
Step 5: Block or allow countries
Go to Country Filtering under the General tab. You’ll see three options:
- Trusted Countries: submissions from these countries skip all spam checks. Use this only for your core market or internal team.
- Country Allowlist: only accept submissions from these countries. Everyone else is blocked. Leave it empty if you don’t need a strict region rule.
- Country Blocklist: reject submissions from these countries. Quick-add buttons let you add common groups, such as China and Russia, African countries or EU countries.
Trusted Countries always override the blocklist. Pick the allowlist if you only serve a few countries. Pick the blocklist if most of your spam comes from a few countries. Save your settings.
Step 6: Turn on Trust proxy headers (if you use Cloudflare)
If your site runs behind Cloudflare or another proxy, go to the Misc tab in oopspam settings and turn on Trust proxy headers. Without it, oopspam sees the proxy’s IP address instead of the visitor’s. Country rules would then match the proxy’s location, not your visitor’s.
Step 7: Test your form
Connect to a VPN server in a country on your blocklist, then submit a Pro Form. The entry should appear in Form Spam Entries with the country as the reason. If you also block VPNs, the reason may say VPN instead, which still confirms the block works.
When a submission is blocked, the visitor sees the spam message on the form. If you set a custom spam message in oopspam, they see that message instead of the default one.
Turn on extra filters
Country blocking alone won’t stop spammers who use a VPN. Combine it with:
- VPN and data center IP blocking: see How to block VPN and data center IP submissions in Bricks Forms.
- Rate limiting: see Protecting forms with rate limiting in WordPress.
- Language filtering: see How to block foreign language spam in WordPress forms.
Review blocked submissions
oopspam logs every entry it checks, so you can see why a submission was blocked and restore real leads. Each log shows the submission content, IP address, email, spam score, reason and timestamp.
You can review entries in two places:
- WordPress dashboard: go to oopspam > Form Spam Entries for blocked entries and Form Ham Entries for accepted ones. If a real lead was blocked, mark it as not spam. Learn more in the form entries guide.
- oopspam Dashboard: see detailed reports, blocking reasons and spam trends over time.
Method 2: Block Entire Countries with Cloudflare
Cloudflare blocks visitors from selected countries before they reach your website. Use it when you face a targeted attack, heavy scraping or a legal reason to restrict a region.
Important: This method blocks your entire website for those countries, not only your Bricksforge forms. Real visitors from those countries won’t be able to read your content either.
How to block countries in Cloudflare
- Log in to the Cloudflare dashboard and select the domain where Bricks runs.
- Go to Security > Security Rules.
- Click Create rule, then select Custom rules. Name the rule (for example, “Block countries”).
- Under When incoming requests match, set Field to Country, Operator to is in, and select the countries.
- Under Then take action, choose Block. Choose Managed Challenge instead if you want real people to get through after a quick check.
- Click Deploy.
Visitors from those countries now get a Cloudflare block page on every URL of your site. For more detail, see Cloudflare’s custom rules documentation or our step-by-step guide on how to block countries in Cloudflare.
Tip: Cloudflare labels Tor traffic with the country code T1 (source). You can add Tor to the same rule to block anonymous visitors.
When should you use Cloudflare?
- You’re under a DDoS attack or heavy bot traffic.
- You must restrict a region for legal or compliance reasons.
- You want to cut server load from regions you never serve.
For spam control alone, keep your site open and filter at the form level with oopspam. If you already use Cloudflare, remember to turn on Trust proxy headers in oopspam (Step 6 above).
Which Method Should You Use?
Use oopspam if you want to stop spam and keep your site open. Add Cloudflare only when you need to block a region from your whole site.
| Method | What it blocks | Can blocked visitors read your site? | Logs with block reason | Best for |
|---|---|---|---|---|
| Bricksforge built-in | Not available | Yes | No | Needs a third-party tool |
| oopspam | Form submissions only | Yes | Yes (WordPress and oopspam Dashboard) | Spam control, region filtering, lead review |
| Cloudflare | Your entire website | No | Cloudflare security events only | Attacks, compliance, server load |
You can also use both: Cloudflare for regions you never want on your site, and oopspam for precise form-level rules on everything else.
FAQ
Can I block countries in Bricksforge without a plugin?
Not inside Bricksforge itself. Pro Forms has no country or IP rules. Without a plugin, your only option is a network firewall such as Cloudflare, which blocks your whole site.
Will country blocking stop spammers who use a VPN?
No. A VPN makes the visitor appear to be in the VPN server’s country. Turn on oopspam’s VPN, proxy and Tor blocking alongside country filtering to close that gap.
Should I use the allowlist or the blocklist?
Use the allowlist if you only serve a few countries, such as a local business. Use the blocklist if your audience is global and spam comes from a few countries.
How accurate is country detection?
Country detection relies on IP geolocation databases, which are accurate for most traffic but can misplace some IP addresses. Check Form Spam Entries regularly and add your core markets to Trusted Countries to protect real leads.
Does oopspam add a CAPTCHA or slow down my form?
No. oopspam checks submissions on the server after the visitor clicks submit. It adds no CAPTCHA and no visible challenge to your Pro Forms.
Final thoughts
Bricksforge Pro Forms doesn’t block countries on its own, but you can add it in a few minutes. oopspam filters submissions by country, language, IP reputation and content, while your site stays open to every visitor. Cloudflare is the heavier option when you need to keep a region off your whole site.
For most Bricksforge sites, start with oopspam’s country filter, add VPN blocking and rate limiting, and check your logs after the first week.
Using another form builder? We also cover country blocking for Bricks Forms, Elementor Atomic Forms, Fluent Forms and more in our complete guide to blocking countries from your website.
