=== CordonAI Geo Access and Redirect ===
Contributors: cordonai
Tags: geoip, country block, geo redirect, security, ip block
Requires at least: 5.3
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.2.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Block or allow WordPress visitors by country and IP, redirect by location, and log activity using an offline GeoIP database.

== Description ==

CordonAI Geo Access and Redirect lets you decide who can reach your WordPress
site based on the visitor's country and IP address. Everything runs through
standard WordPress hooks — the plugin never modifies `wp-config.php`,
`.htaccess`, or any core file.

Country lookups use a bundled MaxMind GeoLite2 database that ships with the
plugin, so **no external request is made when a visitor is checked**. If you
want fresher data you can add a free MaxMind license key and update the
database on demand or weekly.

**Features**

* Block (or allow) front-end visitors by country and by IP address.
* Protect the login page and admin area by country/IP, with brute-force-friendly
  defaults — established administrators are never locked out of the dashboard.
* IP rules support exact addresses, wildcards (`203.0.113.*`) and CIDR ranges
  (`203.0.113.0/24`), for both IPv4 and IPv6.
* Allow-list that always wins over any block rule.
* Crawler allow-list (Google, Bing, Yandex, and more) so blocking a country
  never hurts your search visibility.
* Country redirects, including "keep the current path" (`%PATH%`) redirects.
* Language-prefix URL rewriting for multilingual sites (e.g. `/en/` → `/it/`).
* Logs and at-a-glance charts of blocked activity (24 hours / 7 days / 30 days).
* Fully customisable block screen with a live preview.
* Offline by design — privacy friendly, no tracking, no ads, no upsells.
* Optional MaxMind GeoLite2 auto-update with your own license key.

== External services ==

This plugin can optionally connect to one external service, MaxMind, to update
its bundled GeoIP database. It is used only for downloading database updates and
is never contacted during normal visitor lookups.

* What it is and what it is used for: MaxMind GeoLite2 provides the
  IP-to-country database the plugin uses to detect a visitor's country. The
  bundled copy works fully offline; this service is only used to download a newer
  copy of that database when you choose to.
* What data is sent and when: a request is sent to
  https://download.maxmind.com/app/geoip_download only when a site administrator
  has entered a MaxMind license key and then either clicks "Update database now"
  on the Settings tab or has enabled the weekly automatic update. The request
  includes your MaxMind license key (so MaxMind can authorise the download) and,
  as with any HTTP request, your server's IP address. No visitor data and no site
  content are ever sent. If you do not enter a license key, the plugin makes no
  external requests at all.
* Service provider: MaxMind, Inc.
  GeoLite2 End User License Agreement: https://www.maxmind.com/en/geolite2/eula
  Privacy Policy: https://www.maxmind.com/en/privacy-policy

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/`, or install the ZIP from
   the Plugins screen.
2. Activate the plugin through the "Plugins" menu in WordPress.
3. Open **CordonAI Geo** in the admin menu and configure the Front-end, Login /
   Admin, Redirects and Settings tabs.

== Frequently Asked Questions ==

= Does it call an external service to look up countries? =
No. Lookups use the bundled offline database. The only optional network use is
downloading database updates from MaxMind when you provide a license key (see
the "External services" section above).

= Will blocking a country hurt my SEO? =
Add the relevant crawlers on the Crawlers tab; they are always allowed through,
regardless of country.

= Can I lock myself out? =
Login/Admin country rules could block your own access, so add your IP to the
allow list first. As an extra safeguard, logged-in administrators are never
blocked inside the dashboard.

= Where can I get a MaxMind license key? =
Sign up for a free GeoLite2 account at maxmind.com and create a license key,
then paste it on the Settings tab.

== Screenshots ==

1. Front-end protection with country selector and quick-select buttons.
2. Logs and blocked-activity charts.
3. Block page customisation with live preview.

== Changelog ==

= 1.2.0 =
* New: block unwanted bots by User-Agent — AI/LLM crawlers, SEO and backlink
  crawlers, scraping libraries, security scanners and other aggressive bots —
  independent of the country filters. Allowed crawlers always take precedence.
* Greatly expanded the built-in bot catalogue, grouped by category.

= 1.1.0 =
* Renamed the plugin and improved WordPress.org compliance: the block page is
  styled with inline attributes instead of a style tag, region data is passed via
  wp_localize_script, the optional MaxMind external service is documented in this
  readme, and database updates are written only inside the uploads directory.

= 1.0.0 =
* Initial build: country and IP filtering for front-end and login/admin,
  allow-lists, crawler allow-list, country redirects, language-prefix rewriting,
  logs and statistics, customisable block page, offline GeoIP with optional
  MaxMind updates.

== Upgrade Notice ==

= 1.2.0 =
Adds User-Agent bot blocking (AI scrapers, SEO crawlers, scanners) and an expanded bot catalogue.

= 1.1.0 =
Plugin renamed and updated for WordPress.org review compliance.
