Visitors Bypassing Country Blocks with VPNs

If you have blocked a country but some visitors from that region are still getting through, they may be using a VPN or proxy to mask their real location.

Why This Happens

A VPN (Virtual Private Network) allows a user to route their internet traffic through a server in a different country. This makes it appear as though they are visiting from the VPN server’s location rather than their actual country.

For example, a visitor in China using a VPN with a US server will appear as a US visitor to your store. If you have blocked China but allowed the US, the country blocker will not catch them.

How to Fix It

Enable VPN & Proxy Blocking

The most effective solution is to enable VPN blocking alongside country blocking.

  1. Go to VPN & Bot Blocker from your dashboard.
  2. Enable the VPN & Proxy Blocking toggle.
  3. Keep “Block all VPN users” off unless you want to block all VPNs globally (including iCloud Private Relay and corporate VPNs).
  4. Keep “Allow business VPNs” on to avoid blocking corporate network users.
  5. Click Save.

With both country blocking and VPN blocking enabled, visitors from blocked countries who are also using a VPN will be caught by the VPN detection layer.

Enable Bot Blocking

Many automated visitors from blocked regions use bots, not just VPNs. Enabling bot blocking provides an additional layer of protection.

  1. In VPN & Bot Blocker, enable the Bot Protection toggle.
  2. Start with regular mode (default). Switch to strict mode if you continue to see suspicious traffic.

Block Specific Network Providers (Pro)

If you identify specific network providers or cloud hosting services being used, you can block their entire network using the ASN Blocker (Pro plan only).

For example, if you see bot traffic coming from Amazon Web Services, you can block ASN AS16509 to stop all traffic from AWS.

Limitations

No VPN detection system is 100% accurate. Some residential VPNs or newer proxy services may not be immediately detected. Kedra Shield uses ProxyCheck.io for detection, which covers the vast majority of commercial VPN providers, proxies, Tor exit nodes, and hosting providers.

Combining multiple blocking methods (country + VPN + bot + ASN) provides the strongest coverage.

Next Steps