Using GEOIP to block an ASN or Country on InterServer shared hosting with litespeed

Boost Security: Using LiteSpeed GeoIP for Country or ASN Blocking

Running a website site means you’re a constant target for spam, brute-force attacks, and malicious bots. While firewalls and security plugins are essential, sometimes you need a more fundamental layer of defense. This is where LiteSpeed Web Server’s built-in GeoIP features shine.

Traditionally, GeoIP allowed you to block traffic based on a visitor’s country. But now, InterServer has introduced a powerful new capability: blocking traffic based on its ASN (Autonomous System Number).

Let’s dive into what this means and how you can implement it today.

What is GeoIP and ASN?

GeoIP (Country): This is the classic method. LiteSpeed can identify the country a visitor’s IP address is coming from. If your business only serves customers in the United States, why allow login attempts from 50 other countries?

ASN (Autonomous System Number): This is the next level. An ASN is a unique number that identifies a specific network provider, data center, or ISP (like Comcast, Google Cloud, or a specific bulletproof hosting provider).

Why is ASN blocking so powerful? Sometimes, a single bad actor or bot network operates from hundreds of IPs across multiple countries, but they all originate from the same hosting provider. Blocking that provider’s ASN can stop the entire attack in one rule, which is far more efficient than blocking individual IPs or entire countries.

How to Block Visitors by Country

You can easily add these rules to your .htaccess file at the root of your WordPress installation.

Example 1: Block All Access from a Specific Country

This example blocks all traffic from the United States (US). You can change US to any two-letter country code.
Apache

RewriteEngine on
RewriteCond %{ENV:GEOIP_COUNTRY_CODE} ^US$
RewriteRule ^(.*)$ – [F,L]

RewriteCond %{ENV:GEOIP_COUNTRY_CODE} ^US$: This line checks if the visitor’s country code is “US”.

RewriteRule ^(.*)$ – [F,L]: This line triggers a “Forbidden” (F) error for any request, effectively blocking them. [L] means it’s the last rule to be processed.

You can mix and match as well (US|GB|IN) – would include three countries United States, Great Britain and India

Example 2: Block Access to wp-login.php (Allow list, block others)

This is a much more common and highly recommended security measure. This rule blocks access to wp-login.php and xmlrpc.php from all countries except the ones you specify (in this case, Great Britain, Denmark, the US, and India).
Apache

RewriteEngine on
RewriteCond %{ENV:GEOIP_COUNTRY_CODE} !^(GB|DK|US|IN)$
RewriteRule (wp-login|xmlrpc)\.php$ – [F,L]

!^(GB|DK|US|IN)$: The ! character is crucial. It means “NOT”. This line checks if the visitor’s country is NOT in the allowed list.

RewriteRule (wp-login|xmlrpc)\.php$: This applies the rule only to requests for wp-login.php or xmlrpc.php.

The Next Level: Blocking by ASN (ISP/Network)

This is the new, powerful feature. If you identify that a specific network (like a data center known for spam) is targeting your site, you can block its ASN.

First, you’ll need to find the ASN of the problematic traffic. You can use an online IP-to-ASN lookup tool to find the number associated with IPs from your server logs.

In this example, we’ll block ASN 99999.
Apache

RewriteEngine On
RewriteCond %{ENV:GEOIP_ISP} ^99999$
RewriteRule ^ – [F,L]

RewriteCond %{ENV:GEOIP_ISP} ^99999$: This line checks the “ISP” (which corresponds to the ASN) against the number you want to block.

RewriteRule ^ – [F,L]: Just like before, this blocks all requests (^) from that ASN.

How to Verify Your GeoIP Configuration

How do you know if GeoIP is active and what data it’s seeing? You can configure LiteSpeed to pass GeoIP data to PHP as $_SERVER variables, which you can then check on a phpinfo.php page.

Note: This requires configuration in your LiteSpeed settings (e.g., in LiteSpeed WebAdmin Console or OpenLiteSpeed WebAdmin) to map the GeoIP database to a variable name.

Example Configuration

In your LiteSpeed configuration, you might define a mapping like this to create a custom PHP variable:

MyTest2_COUNTRY_CODE COUNTRY_DB_20190402/country/iso_code

Checking in PHP

Once configured, create a file named phpinfo.php in your site’s root with the following content:
PHP

When you visit yourdomain.com/phpinfo.php in your browser and scroll down to the “PHP Variables” section, you will see the variable you defined. It will show the country code of your current IP address.

_SERVER[“MyTest2_COUNTRY_CODE”] US

If you see this, you know that LiteSpeed is correctly identifying your location, and your .htaccess rules based on that data will work. (Remember to delete the phpinfo.php file when you’re done for security!)

Final Thoughts

LiteSpeed’s GeoIP capabilities provide an incredibly granular way to control who can and cannot access your WordPress site. By moving beyond simple country blocking and into the new realm of ASN blocking, you can stop sophisticated attacks at the server level before they ever get a chance to run a single line of PHP.