Geo Restrict Your Shopify Store to Specific Countries

TL;DR: If you sell to only one country or a short list of markets, allowlist those countries and block the rest. This is the inverse of a blocklist: instead of naming the few countries you keep out, you name the few you let in and everyone else hits the block screen. Verified search engines like Google stay allowed regardless, so SEO is safe. Cordon does this at the edge in under 50 milliseconds.

Most country-blocking guides assume you sell globally and want to keep a few bad regions out. That is a blocklist, and we covered it in how to block a country on Shopify. This guide is the opposite. If you ship to only Germany, or only the Nordics, or only the US and Canada, then the other 190-plus countries are not customers. They are noise. This is how you flip the default and let only your markets through.

Blocklist vs allowlist: pick the right default

The two approaches solve different problems, and choosing the wrong one makes your rules brittle.

A blocklist starts from "everyone is allowed" and names the exceptions to block. It fits a store that sells worldwide and wants to keep out two or three fraud hotspots. The list stays short because you are excluding a handful of countries.

An allowlist starts from "everyone is blocked" and names the exceptions to allow. It fits a store that serves one country or a small cluster. Here the allowlist stays short because you are including a handful of countries, and the block covers everything you did not name.

The rule of thumb: list whichever set is smaller. If you keep out 3 countries, blocklist. If you serve 3 countries, allowlist. Trying to blocklist 190 countries one flag at a time is a mistake, and you will miss some. Allowlisting the 3 you serve is exact and takes a minute.

Why merchants allowlist countries

If you have run a single-market store for a year and looked at your logs, the case for allowlisting writes itself. Every visitor from a country you will never ship to is one of these:

• Fraud attempts. Stolen cards get tested against stores that will process any region. If you only ship to one country, a checkout attempt from three time zones away with a mismatched billing address is a red flag, not a sale.
• Scrapers and price bots. A large share of catalog scraping comes from datacenter networks in a predictable set of regions. If you serve one market, none of that traffic is a customer, so there is no reason to serve it your product data. See stop competitors scraping your prices.
• Support tickets from people who can never buy. Every "why can't I check out" email from a country you do not ship to is time spent on a non-customer.
• Chargebacks. Orders from regions you cannot fulfill turn into disputes. Keeping the traffic out keeps the disputes out. More on that in reduce chargebacks by blocking fraud traffic.
• Skewed analytics. Sessions, bounce rates, and conversion numbers are all polluted by traffic that was never going to convert. Cutting it makes your reports reflect your actual market.

Allowlisting is not about disliking other countries. It is about only serving the market you actually sell to.

Why Shopify Markets does not do this

This trips up most merchants, so let's be precise.

Shopify Markets controls where you sell. It sets which countries appear in your market settings, which currencies and prices show, and where you ship. If a country is not in a market, a customer there cannot complete checkout with a local shipping address.

Shopify Markets does not stop anyone from visiting. A visitor from an excluded country can still load every page, read every description, download every image, add to cart, and pull your entire catalog through /products.json. Markets is a selling configuration, not a traffic filter. Shopify's own help docs cover markets, duties, and shipping zones, but visitor-level restriction is out of scope for the platform.

So if your goal is "only people in the country I serve should be able to browse my store," Markets alone does not get you there. You restrict at the traffic level, which is what an allowlist does.

How allowlist mode works in Cordon

The mechanism is one rule you already understand: allow rules always win over block rules. In allowlist mode you turn that into a policy:

1. Add allow rules for the countries you serve.
2. Set the default action to block, so anything not explicitly allowed is stopped.

Now only your named countries pass. Everyone else hits the block screen. Because allow rules win, you can still layer specific IP allow entries on top for known exceptions (more on that below).

The point that saves your SEO: verified search engines are always allowed, even in allowlist mode, and cannot be blocked. Crawler verification runs before your country allowlist is evaluated. A request claiming to be Googlebot is checked against Google's real network at the rDNS level. If it verifies, it is allowed no matter what your country rules say. So Googlebot crawling from a US datacenter still reaches a store that only allows Germany. The same holds for Bing, and for the good bots that feed AI search (GPTBot, ClaudeBot, PerplexityBot) and SEO tools like Ahrefs. A fake Googlebot from a non-Google network fails verification and gets blocked like any other unlisted visitor. We covered this in depth in do bot blockers hurt SEO?.

For everyone who is blocked, the block screen is customizable. Instead of a raw error, show a polite message explaining that you currently ship only to your markets, with a link or a redirect if you want to send them somewhere useful.

Set up allowlist mode in Cordon

Here is the full flow.

1. Install Cordon from the Shopify App Store. It installs as a theme app extension, so no code edits and no script tags.
2. Open the country rules in the embedded admin and use the one-click flag picker.
3. Add allow rules for the countries you serve. Click the flag for each market you actually sell to. If you ship only to Germany, that is one flag.
4. Set the default action to block. This is what makes it an allowlist. Everything you did not name is now blocked.
5. Customize the block screen with a short message explaining you ship only to your listed regions, so blocked visitors understand rather than assuming your store is broken.
6. Add IP allowlist exceptions for known people outside your served countries: a supplier, an agency, a founder who travels. IP allow rules win over the country default.
7. Save. Rules are live immediately. Open the live visitor log to watch decisions in real time. It shows country, ASN, and the exact rule that fired, with IPs SHA-256 hashed under a daily-rotating salt so the log is GDPR-safe.

Country allowlisting works on every plan, including the Free plan. See the feature list for the full rule set.

Be honest about the edge cases

Allowlisting by country is a blunt instrument by design, and it has known trade-offs. Do not deploy it without understanding them.

Travelers and expats from your country get blocked. An allowlist blocks by where the visitor is right now, not who they are. A German customer on holiday in Spain appears as Spain and gets blocked from your Germany-only store. If you know that person, add their IP to the allowlist and it overrides the country rule wherever they connect from. For unknown travelers, the block screen message matters: make it clear what is happening rather than looking broken.

VPN users appear in the wrong country. Someone in your allowed country routing through a VPN endpoint abroad looks foreign and gets blocked. The reverse is the real risk: a visitor abroad routing through a VPN endpoint inside your allowed country looks local and slips through the allowlist. That bypass is exactly what VPN, proxy, and Tor detection closes. On the Growth plan and up, Cordon flags those connections so a faked location does not pass your allowlist. See VPN and proxy checkout fraud for how that detection works.

Known exceptions belong on the IP allowlist. The pattern is: country allowlist for the broad rule, IP allow entries for the specific humans who need through anyway. Because allow rules always win, one IP entry beats the country default cleanly, no matter how strict the rest of your policy is.

Blocklist and allowlist can coexist

You do not have to pick one forever. A common setup is an allowlist for the broad geography plus targeted blocks inside it. For example, allow the US and Canada, then still block specific datacenter ASNs or single fraud IPs you have seen inside those countries. Allow rules win, block rules catch the rest, and the default action handles everyone unlisted. It is one rule set, evaluated in a fixed order, so the behavior is predictable rather than a pile of conflicting toggles.

Frequently asked questions

What is the difference between blocklisting and allowlisting countries?

A blocklist names a few bad countries to keep out and lets everyone else in, which fits stores that sell globally. An allowlist names the few countries you serve and blocks everyone else, which fits stores that ship to only one or a handful of markets. Allowlisting is simpler and safer when your served list is short because you never have to name all 190-plus countries to exclude.

Does Shopify Markets restrict who can visit my store by country?

No. Shopify Markets controls where you sell, which currencies show, and where you ship, but it does not stop anyone from any country from browsing your store, adding to cart, or scraping your catalog. Restricting who can visit requires an app or your own edge infrastructure in front of the store.

Will allowlisting only a few countries hurt my SEO?

No. Verified search engines like Googlebot and Bingbot are always allowed regardless of your country rules, even in allowlist mode. Googlebot crawling from a US datacenter still reaches a store that only allows Germany, because crawler verification runs before your country allowlist is checked.

What happens to a customer from my target country who is traveling abroad?

An allowlist blocks by where the visitor is right now, not who they are, so a customer from your allowed country browsing from a different country will be blocked. If you know that person, add their IP to the allowlist and it overrides the country rule so they get through wherever they are.

Can someone use a VPN to fake being in my allowed country?

Yes. A VPN endpoint inside your allowed country makes a visitor appear local, which is the standard way to slip past a country allowlist. VPN, proxy, and Tor detection on the Growth plan and up catches those connections so a faked location does not pass.

Wrapping up

If you sell to one country or a short list of markets, allowlisting is the cleaner default: name what you serve, block the rest, and let verified search engines through untouched. It takes a minute to set up and it survives theme updates because it runs at the traffic level, not in your theme. Try Cordon on the Shopify App Store. Country allowlisting is on the Free plan, and every paid plan has a 7-day free trial. Full details are on the pricing page and in block traffic by country.