I use Cloudflare on my website and configured it to block visitors from Singapore, including interactive challenges and Bot Fight Mode. However, I'm still seeing traffic from Singapore, and the volume appears to have contributed to a five-day AdSense suspension. My site is hosted with Hostinger, and I'm considering testing their CDN as well to see whether it handles the country-level blocking more reliably, although I understand that using multiple CDNs can cause problems. Could the traffic be bypassing Cloudflare, or could it be automated traffic that Cloudflare is not identifying correctly? What should I check to make sure Singapore traffic is actually blocked and that requests cannot reach my server directly?
2 Answers
Country-based IP blocking is not always perfect because IP geolocation databases can be outdated or inaccurate, and automated traffic may also be using changing or misclassified addresses. Review your server and analytics logs, compare the source IPs against current threat-intelligence lists, and block abusive addresses or request patterns at the origin as well. Make sure you’re distinguishing actual Singapore-based users from traffic merely labeled as Singapore by an analytics service.
First check whether requests can reach your hosting server directly instead of going through Cloudflare. Configure the origin firewall to allow web traffic only from Cloudflare’s published IP ranges, and deny everything else. Otherwise, visitors and bots can bypass Cloudflare entirely, making its country rules and bot protections ineffective.
How do I configure the server so that only Cloudflare’s edge IPs can connect to it?