Country blocking

This is not a separate rule type in the interface but a built-in WAF mechanism that runs after the IP rules. It blocks traffic from the countries listed in the iskwaf_iskwaf_blocked_countries system setting.

How it works: the blocking decision is made at request time using IP geolocation data, which is regularly updated by a cron script.
Priority: this check has a lower priority than IP rules. If an IP address has an allowing (`allow`) rule (for example, for a Google subnet), the visitor is let through even if their country is blacklisted.