How to Block Countries in eForm?
Co-founder & Brand Designer
Reviewed by Onar Alili
Co-founder & Engineer
Published 8 min read
eForm has no built-in country blocking. To block countries, use the oopspam Anti-Spam plugin (that’s us 👋) to filter eForm submissions by country, or use Cloudflare to block whole countries from your website. For most sites, form-level filtering is the better choice because your site stays open to everyone.
eForm is a WordPress form builder by WPQuark for quizzes, surveys, cost estimators, payments and registration. Spam from countries you don’t serve can skew survey results, fill leaderboards and create fake accounts. Blocking those countries is a quick way to cut the noise.
Does eForm Have Built-In Country Blocking?
No. eForm’s Submission Limitation settings cap entries per email, IP address, user, cookie or in total, but none of them look at where a visitor is located. eForm’s GPS locator element can record a visitor’s location, but it doesn’t block submissions. To block countries, you need a third-party tool. We cover eForm’s built-in protection in 6 Ways to Protect Your eForm from Spam.
Method 1: Block Countries in eForm with oopspam
oopspam Anti-Spam supports eForm natively from plugin version 1.2.87. It checks each submission on the server before eForm saves it. Visitors from blocked countries can still read your site. They just can’t submit your forms.
What oopspam Adds to eForm
- Country filtering: block or allow submissions from selected countries
- Trusted countries: let your core markets skip spam checks
- Language filtering: reject messages written in languages you don’t support
- VPN, proxy and data center blocking: stop visitors who hide their real location
- Rate limiting: cap how often one IP or email can submit
- Logs: see every blocked entry and the reason it was blocked
How to Set It Up
Step 1: Install the oopspam plugin
In WordPress, go to Plugins > Add New, search for oopspam Anti-Spam, then install and activate it. You can also download it from the WordPress plugin directory. Make sure you run version 1.2.87 or later.
Step 2: Get your API key
Create a free oopspam account and copy your API key from the dashboard.
Step 3: Connect the API key
Go to Settings > oopspam Anti-Spam. Paste the key into My API Key and select oopspam Dashboard as the key source. Save your changes.
Step 4: Turn on eForm protection
Scroll to the eForm Form Builder section and check Activate Spam Protection. This covers every eForm form on your site.
Step 5: Block or allow countries
Go to Country Filtering under the General tab. You’ll see three options:
- Trusted Countries: submissions from these countries skip all spam checks. Use this only for your core market or internal team.
- Country Allowlist: only accept submissions from these countries. Everyone else is blocked. Leave it empty if you don’t need a strict region rule.
- Country Blocklist: reject submissions from these countries. Quick-add buttons let you add common groups, such as China and Russia, African countries or EU countries.
Trusted Countries always override the blocklist. Pick the allowlist if you only serve a few countries. Pick the blocklist if most of your spam comes from a few countries. Save your settings.
Step 6: Turn on Trust proxy headers (if you use Cloudflare or another proxy)
If your site runs behind Cloudflare or another proxy, go to the Misc tab and turn on Trust proxy headers. Without it, oopspam sees the proxy’s IP address instead of the visitor’s, and country rules match the wrong location.
Step 7: Test your form
Connect to a VPN server in a country on your blocklist, then submit an eForm form. The visitor sees your spam message on the form. Set a custom message in the eForm Spam Message field to explain the block, for example “We can’t accept submissions from your region. Please email us instead.”
The entry appears in Form Spam Entries with the country as the reason. If you also block VPNs, the reason may say VPN instead, which still confirms the block works.
Review Blocked Submissions
oopspam logs every entry it checks, so you can see why a submission was blocked and restore real entries. Go to oopspam > Form Spam Entries for blocked entries and Form Ham Entries for accepted ones. Learn more in the form entries guide.
Turn On Extra Filters
Country blocking alone won’t stop spammers who use a VPN. Combine it with:
- VPN and data center IP blocking: see How to block VPN and data center IP submissions in eForm.
- Rate limiting: see How to limit form submissions in eForm.
- Language filtering: see How to block foreign language spam in WordPress forms.
Method 2: Block Entire Countries with Cloudflare
Cloudflare blocks visitors from selected countries before they reach your website. Use it when you face a targeted attack, heavy scraping or a legal reason to restrict a region.
Important: This method blocks your entire website for those countries, not only your eForm forms.
- Log in to the Cloudflare dashboard and select your domain.
- Go to Security > Security Rules.
- Click Create rule, then select Custom rules. Name the rule (for example, “Block countries”).
- Under When incoming requests match, set Field to Country, Operator to is in, and select the countries.
- Under Then take action, choose Block, or Managed Challenge if you want real people to get through after a quick check.
- Click Deploy.
See Cloudflare’s custom rules documentation or our guide on how to block countries in Cloudflare.
Which Method Should You Use?
| Method | What it blocks | Can blocked visitors read your site? | Logs with block reason | Best for |
|---|---|---|---|---|
| eForm built-in | Not available | Yes | No | Needs a third-party tool |
| oopspam | Form submissions only | Yes | Yes | Spam control, region filtering |
| Cloudflare | Your entire website | No | Cloudflare security events | Attacks, compliance, server load |
FAQ
Can I block countries in eForm without a plugin?
Not inside eForm. Its limits work by email, IP, user, cookie or date, not location. Without a plugin, your only option is a network firewall such as Cloudflare, which blocks your whole site.
Will country blocking stop spammers who use a VPN?
No. A VPN makes the visitor appear to be in the VPN server’s country. Turn on oopspam’s VPN and cloud provider blocking alongside country filtering.
Should I use the allowlist or the blocklist?
Use the allowlist if you only serve a few countries, such as a local business. Use the blocklist if your audience is global and spam comes from a few countries.
How accurate is country detection?
It relies on IP geolocation databases, which are accurate for most traffic but can misplace some IP addresses. Review Form Spam Entries regularly and add your core markets to Trusted Countries.
Final Thoughts
eForm doesn’t block countries on its own, but you can add it in a few minutes. oopspam filters submissions by country, language, IP reputation and content while your site stays open to every visitor. Cloudflare is the heavier option when you need to keep a region off your whole site.
For more, see our complete guide to blocking countries from your website.
