How to block users from specific countries to access my site

[francescopetrucci]

Hi. I have good reasons to prove there is a scammer in Africa posting listings and trying to scam users in my listinghive site. I want to block all users from Africa to access my site so I can prevent this thing from happening maybe. Could anyone please give me advise on how to do so?

Thank you!

[ChrisB]

Hi @francescopetrucci,

Whilst this isn’t a HivePress specific issue, you could look into using a plugin like WordFence to block users from certain countries from accessing your site. They offer various free tools to help improve site security, however their specific Country Blocking feature is part of their premium features meaning you’ll need to upgrade to use it.

There’s certainly other approaches you could take, but they’ll likely need more maintenance going forwards. (i.e keeping and updating a list of known spam/scam IP addresses to block.)

I hope this helps!

Cheers,
Chris

[kseniia]

Hi,

In addition to ChrisB’s recommendations, if your site doesn’t receive a high volume of new listings, you can enable manual listing approval in HivePress > Settings > Listings.

Hope one of these solutions works for you.

[francescopetrucci]

Hi. Maybe to solve this issue (scammers) is there a way I can manually check the IP from each listing and see whether that matches the address listed on the site?

[Info1]

hi i am having problems with scammers as well. Check thoroughly the ip address they are likely using VPN, Tor or Proxy network. You may use Ipqualityscore service to block them from accessing your site. Scammers are likely not local and not use their residential ip as will want to hide their identity / ip address.

Other recommended Implementation
-Phone SMS verification (most effective)
-Server-side session management
-Expand VPN/datacenter IP ranges
-Add reCAPTCHA for suspicious behavior
-Behavioral scoring system
-Rate limiting - 120 requests per 5 minutes is reasonable
-SSL Verification
-Honeypot Fields- Add it to catch bots
-Time-based Validation - 3-second minimum helps block automated submissions
-IP/ISP Logging - Good for tracking patterns
-Fail-open approach - Avoid blocking legitimate users when services are down

I am also blocking a wide range of IP which i do not recommend for you as it might be too broad but it works for me as i just had enough of them (i am having an online war with them for months). I am still working to hardening my system. That said there will always be loopholes but you can make it harder for them.

These are very very broad ip range that you could block manually. Use at your own risk.

add_filter(‘rentify_known_vpn_cidrs’, function($ranges) {
return array_merge($ranges, [
// Major cloud providers
‘3.0.0.0/8’, ‘18.0.0.0/8’, ‘52.0.0.0/6’, // AWS
‘34.64.0.0/10’, ‘35.184.0.0/13’, // Google Cloud
‘13.64.0.0/11’, ‘20.0.0.0/8’, // Azure
‘104.131.0.0/16’, ‘159.65.0.0/16’, // DigitalOcean
‘198.23.0.0/16’, ‘199.87.0.0/16’, // Common VPNs
‘45.76.0.0/16’, ‘45.77.0.0/16’, // More Vultr
‘185.0.0.0/8’, ‘195.0.0.0/8’, // European datacenters
]);
});

[francescopetrucci]

is there a way to do sms verification through hivepress? My problem is that there is a scammer from Nigeria who wants to steal data from other users and everyone is so angry at me because of this. On top of that, he is trying to make fake payments everyday filling my transactional email counts. I really need to fix this asap but thank you for the tips

[Info1]

Same problem here. I am getting scammers from hongkong, china, cambodia. Huge amount of scammers using res proxy. Firstly setup VPN blocker and block the country nigeria. For SMS verification you need to custom code. Use chatgpt to help you code if you are unsure.

[Info1]

another quick easy option is to use the membership plugin and have all users pay to contact listings. however this comes at a cost. expect alot of user to bounce

[kseniia]

Hi,

Thanks for pointing this out, your feedback helps us prioritize features for development.

While this feature isn’t currently available, we’re planning to implement it. In the meantime, if you’re comfortable with coding, please check out this thread where our developer provided general guidance on how to achieve this functionality:

How Add phone numder field to registration form and verfiy with OTP

Sorry, there’s no simple code snippet or guidance for this because this requires a custom implementation. If you’re familiar with customizations, please try the following suggestions: Use a custom function for the hivepress/v1/models/user/login action, to log the user out (and block the default login this way) and perform any initial actions related to OTP (e.g. sending an SMS). Use a custom function for the hivepress/v1/forms/user_login filter, to set a redirect URL for the login form, th…

[francescopetrucci]

@Info1

Same problem here. I am getting scammers from hongkong, china, cambodia. Huge amount of scammers using res proxy. Firstly setup VPN blocker and block the country nigeria. For SMS verification you need to custom code. Use chatgpt to help you code if you are unsure.

thank you. is there a way to manually verify each listing IP address and see if it is the same of the one posted on the listing?

[francescopetrucci]

@francescopetrucci

thank you. is there a way to manually verify each listing IP address and see if it is the same of the one posted on the listing?

thank you. is there a way to manually verify each listing IP address and see if it is the same of the one posted on the listing?

[kseniia]

You can try security plugins that prevent spam and block registrations from the same IP address. If you want to check this manually, consider using plugins such as User IP and Location – WordPress plugin | WordPress.org.

Hope this helps.

[francescopetrucci]

@francescopetrucci

@francescopetrucci

thank you. is there a way to manually verify each listing IP address and see if it is the same of the one posted on the listing?

Hi! is there any feature involving a 2steps verification during the creation of a user on listinghive (like email verification, I don’t know…)?

[ChrisB]

Hi @francescopetrucci,

In the backend of WordPress, Visit HivePress > Settings > Users.

Find and enable this option to require users to validate their emails.

Cheers,
Chris

[Info1]

Do take note 2 step email verification does not stop scammers as they can just create many emails. You need an IP based solution + phone OTP verification combo. Take note scammers now are sophisticated. If you want to go further track based on device and block.