> For the complete documentation index, see [llms.txt](https://fraud-block-ip.labxapp.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://fraud-block-ip.labxapp.com/documentation/core-concepts/blocking-rules.md).

# Blocking Rules

Every rule type you can use to block, redirect, or allow storefront visitors.

Each rule type lives in its own tab under **Blocking Rules**. Every rule type supports the same three actions — **Block**, **Redirect**, and **Allow** — and can be toggled on/off without deleting it.

| Rule type      | Matches on                                          | Typical use                                         |
| -------------- | --------------------------------------------------- | --------------------------------------------------- |
| **IP**         | A single IP, CIDR range, or wildcard                | Block a known bad actor or abusive IP               |
| **Country**    | Visitor's country (from IP geolocation)             | Block regions you don't ship to or that drive fraud |
| **Region**     | State/province-level location                       | Finer-grained geo control within a country          |
| **ISP**        | ISP name or ASN (`AS15169`)                         | Block a specific hosting provider or network        |
| **User Agent** | Browser, OS, or device class, or a raw UA substring | Block a specific browser/bot signature              |
| **Referral**   | Referring domain or full URL                        | Block traffic arriving from a specific site         |
| **Product**    | A product or collection page                        | Restrict access to specific storefront pages        |

## Bot protection (Settings)

Separate from the rule tabs, **Settings > Mitigator** has toggles for:

* **Unknown bots** — block traffic that looks automated (curl, headless browsers, scraping tools)
* **Tor** — block Tor exit node traffic
* **Datacenter / hosting IPs** — block traffic from cloud/hosting providers instead of residential ISPs
* **Good bots** — keep this on so Googlebot, Bingbot, and other trusted crawlers are never blocked

## Country exceptions ("block all except")

Country rules support an *inverted* mode: instead of blocking a list of countries, you allow only the countries you list and block everywhere else. Enable this from the Country tab's mode toggle.

See [Block Page Customization](/documentation/reference/block-page-customization.md) to control what a blocked visitor actually sees.