Access control lets you decide who can reach your storefront based on device type, country, and whether the visitor uses a VPN or proxy. Settings are per store and apply as soon as you save. You need the Settings permission to change them. The panel starts with a Use with caution warning: anyone outside what you allow gets a 403 forbidden page instead of your store, so check your rules against where you actually sell.
Opening access control
- Go to Settings.
- Open the Access control card.
- A single panel opens with the Devices field, the Block VPNs and proxies toggle, and the Restriction Method selector beside the Countries picker. Make your changes and click Save.
Devices
The Devices multi-select chooses which device types may view your store. The four options are:
- Desktop
- Mobile
- Tablet
- Television
The device type is detected automatically from the visitor's browser. You must keep at least one device selected, otherwise you see "Please select at least one device". Keep all four selected to allow every device. A visitor on a device type you did not select cannot open your store.
Block VPNs and proxies
Turn on Block VPNs and proxies to stop anyone whose connection is detected as a VPN or proxy from reaching your store. This check applies to every visitor regardless of country, not only the countries in your list, so a masked visitor is blocked even when no country restriction is set. It is most useful for cash-on-delivery stores that want to keep out orders placed from hidden locations.
Restriction Method
The Restriction Method selector controls how the country list is applied. The detected country comes from the visitor's IP location. There are three options:
- None (allow traffic from all countries): no country filtering. This is the default and the Countries list is ignored.
- Blacklist (allow traffic from all countries except the selected ones): every country is allowed except the ones you add to the Countries list.
- Whitelist (allow traffic only from selected countries): only visitors whose detected country is in the Countries list get in. Everyone else is blocked.
If you pick None, or leave the Countries list empty, no country filtering is applied. Choosing None also hides the Countries picker and the Selected Countries table, because neither one has any effect while every country is allowed.
Countries
The Countries searchable multi-select is where you pick the countries the chosen method applies to. Each country shows its flag and name. A Selected Countries table underneath lists what is currently saved. Adding or removing a country only takes effect when you click Save.
What a blocked visitor sees
Blocked visitors (wrong device, detected VPN or proxy, or a country the method excludes) are shown a forbidden page instead of your store. The page does not reveal which rule blocked them.
Verified search-engine crawlers (such as Googlebot, Bingbot, and Facebook's link-preview fetcher) skip all of these gates, so your store stays indexable and link previews keep working even with VPN blocking, a country whitelist, or device limits in place.
Saving
Click Save. The message "The access control has been updated successfully" confirms it, and the rules apply on the visitor's next page load. To remove all restrictions, select all four devices, set the method to None, turn off VPN blocking, and save.
If legitimate visitors are blocked
- Confirm the Restriction Method is the mode you intend. Whitelist blocks everyone not on the list; blacklist blocks only the listed countries.
- Check whether the customer's country is, or is not, in the Countries list as expected.
- If a customer is blocked despite being in an allowed country, they may be on a VPN or proxy. Ask them to disconnect, or turn off Block VPNs and proxies.
- Confirm the customer's device type is included in the Devices selection.
- To test what a buyer in another country sees, use the Virtual VPN app.
Related
Access control filters traffic by rules. To review or release individual IP and device bans, see Logins and banned sessions. For bots and fake orders, see Shield.