Blocking all countries expression & modification

[svenskmb]

Im wondering if I have configured the expression correctly? I want to block all countries except sweden from visiting the website, and I can see that something is happening but I still see a lot of request from other countries so Im wondering if im missing something?

Also, whats the difference in outcome if I brake up the expression into two rules, the first rule to block all countries thats not equal to sweden, and the 2nd rule to block all the wordpress request? Can it affect google from indexing the website?

((http.request.uri.path contains “/wp-content/plugins/” and not http.referer contains “svenskmediabevakning.se” and not cf.client.bot) or (http.request.uri.path contains “/wp-content/cache/” and not http.referer contains “svenskmediabevakning.se” and not cf.client.bot) or (http.request.uri.path contains “/wp-includes/” and not http.referer contains “svenskmediabevakning.se” and not cf.client.bot) or (http.request.uri.path eq “/wp-comments-post.php” and http.request.method eq “POST” and not http.referer contains “svenskmediabevakning.se”) or (http.request.uri.path contains “/xmlrpc.php”) or (http.request.uri.path contains “/wp-login.php”) or (http.request.uri.path contains “/wp-admin/” and not http.request.uri.path contains “/wp-admin/admin-ajax.php” and not http.request.uri.path contains " /wp-admin/theme-editor.php")) and ip.geoip.country ne “SE”

[sdayman]

That sure looks like the hard way for whatever it is you’re trying to accomplish. I see you’re trying to block requests to resources if the referrer isn’t your domain, and blocking other resources. Then capped it off with “all of that, AND it’s not coming from SE.”

Checking referrer isn’t really effective, because many bots will include your domain as the referrer.

If you don’t want non-Sweeden visitors, except for “good” bots (Googlebot, etc.), then create a rule for If Not Known Bot AND Not Sweeden, then block. That should take care of most everything, since Sweden isn’t a real hotbed of malicious activity.

After that, watch your traffic and add another rule to block the rest.