How can I block users from a certain country to access my site on Business Catalyst?

have you got an example of the script workaround?

This solution requires jQuery to be loaded on your site either in the HEAD of your document or before you include this script in your BODY tag.

<script type="text/javascript">

var userCountryCode = "{module_visitorcountrycode}";

var disallowedCountryCodes = ["US", "UK"];

var redirectBlockedUsersURL = "/country-blocked.html";

(function($) {

  $.each(disallowedCountryCodes, function(i,val) {

    if ( val == userCountryCode ) {

      window.location = redirectBlockedUsersURL;

    }

  });

})(jQuery);

</script>

All you need to do is update the "disallowedCountryCodes" variable to all the country codes you don't want to have access to your site.  If you only want one country then it will be "var disallowedCountryCodes = ["US"];"

Then, create a page on your BC site that tells the user browsing is blocked for their country.  You can do something like:

<p>Sorry, but your country, {module_visitorcountrycode}, is not allowed to view this site.</p>

Save that file and remember the URL of that page.

Then update the "redirectBlockedUsersURL" variable to the URL of the page you created telling them they are blocked.  You can use a root-relative URL like I do above (ie- "/country-blocked.html") or an absolute URL (ie- "http://yoursite.com/country-blocked.html")

Once you've updated the variables in the script below, you can place the whole code block at the end of your page template or include what's between the <script> tags in a javascript file you're already including in your page template.

Let me know how it works out.

You can do this with pure CSS and other variations in Javascript as well

If you have the body class with the country code in it any children can be effected in pure CSS based on the country code rendered.

So you can simply hide everything other then a div at the end of your html with a message that is rendered how ever you want.

You can also have better javascript that is not inline in javascript files, create a function and target the body class..

if - $('.US') - Then .....

In your function.

Pure javascript with no jQuery can be used as well, you dont have to use jQuery as theTrickster indicated.

I realize I could just use a for statement for regular DOM scripting but most sites have jQuery lately-- it's a pretty safe bet.  The reason I didn't use a body class for this is because I wasn't entirely sure they only wanted one country to be blocked.  This solution allows one or many countries that match to be redirected.  If you only need one country blocked, then, yes it would be simpler to add to the body class and do it via CSS.

Sometimes I prefer to use inline javascri[pt in my pages-- yes I know it looks a little messy on code view but that's one less server connection I have to worry about and especially for users on lesser internet connections that matters-- plus I can use modules in my script above when it's inline.

Actually I guess that you can just do it all via CSS even with multiple blocked countries:

body.US #content, body.UK #content {

  display: none;

}

body.US #blocked-country, body.UK #blocked-country {

  display: block;

}

I was trying to block every country other than Australia

Would the JS be placed on each teamplate on the wesbite. So this way you block any other country coming to your site.

You could include it at the bottom of all your template pages that are used to serve any pages on your site for it to be most effective.

As for making it work to block everything except AU, the javascript would be:

<script type="text/javascript">

var userCountryCode = "{module_visitorcountrycode}";

var allowedCountryCodes = ["AU"];

var redirectBlockedUsersURL = "/country-blocked.html";

(function($) {

  $.each(allowedCountryCodes, function(i,val) {

    if ( val != userCountryCode ) {

      window.location = redirectBlockedUsersURL;

    }

  });

})(jQuery);

</script>

All I changed was the variable name for semantics from "disallowedCountryCodes" to "allowedCountryCodes", filled that variable array with just "AU" as the only value and changed the IF statement to say if the value of the allowedCountryCodes array is NOT equal to our visitor's country code then redirect them to an error page.

IMPORTANT: Make sure your error page that you are redirecting them to does not have the javascript or you'll be stuck in an infinite loop.  Also, I would make sure there's no navigation or anything to the rest of the site-- you should make it as plain as possible.

You can put the above code at the bottom of every template that serves a page you want to block non-AU users from, near the closing </body> tag for most effectiveness.

Just adding my 2cents, on the client side you can't block anything in the browser once it has been sent to the browser, you can only hide it or destroy it (as quick as you can) if a condition is met, so make sure you understand any user could easily edit the HTML in firebug or simular in the browser to get around this for anyone somewhat technically minded.

This is just a conditional redirect script in javascript and if they have javascript disabled it won't work and they'll see the site. It's definitely not foolproof but it will probably dissuade the bulk of the average users from navigating your site.

That is the issue doing it inline and having to add it to multiple templates etc.

If you have external scripting it is implement once and run anywhere/everywhere.

If you need to change it, one place only and also more effecient.

@BCMan - Not if you do it in CSS or implement scripting in the right way. Bad scripting that will happen, but not if you do it correctly.

@Liam: Impossible mate, the RAW HTML data is sent to the client's browser, there is nothing in the middle between the browser and server to "block" it, once sent the browser thats it, it is downloaded and can be edited (CSS included), in the browser to see any "blocked" data.

@liam and BC Man

Liam if you are happy to create the script i can place on my site and we can test it. I think this would benefit the whole commuity.

I know that WP Sites have a plugin that can stop countries coming to the site.

Being able to do this is very useful for local or country only websites.

What do you think

WP plugin's (95% of them) run on the server backend, we can't do that with BC, the only truely secure way would be a way of not sending the content to the browser in the first place.

You could keep all the content on BC but query an offsite proxy that handled the request and ONLY returned the URL / content when the condition was met (in this case valid country). Would require someone or yourself to host a ultra simple PHP or .net file outside of BC. There would also be a minor delay while all this happened on load but shouldn't be a major deal.

Any other method is going to expose either the content (hidden or removed after the fact) or the URL to where the "blocked" content is, but like trickster said definitely not foolproof but it will probably dissuade the bulk of the average users from navigating your site.

Well you can see from thetrickster's comments he does it, I do it. Your not thinking the right lines.

Ideally 3600Online you need a server side sollution.

But using the Device type tag, css and some scripting you can have a very seamless sollution. All you need is the code Bogdan wrote as a response to someone else. (which also disproves TheBCMan's thinking)

I will try find it and post it up for you. Since Bogdan already gave a great sollution which you can take further.

Liam: Stop it with the personal attacks when you see an answer you disagree with mate, even the trickester said you could get around it. You are really straight up incorrect here in thinking you can make something secure in the client side and you shouldn't be telling people the wrong information, espically with regards to security.

Post your solution, but I think it will be pulled to bits in seconds if it is client side only. It so easy to edit the CSS / HTML / Javascript using something like firebug and view / change anything you want. HTML isn't set in concreate once it has left the server.

While perfectly okay, the solutions above give the illusion of protection, which is all that is required on some jobs and okay, but don't think for a second it is foolproof

Not attacking you at all, just the information if I dont think it is correct I will say so.

Script - get around, CSS, get around.

Bogdans sollution though does what you said you can not do though, not my sollution, Trickster showed the basics of a CSS option. In terms of easy editing though - No, not if you do it right.

And the amount of users who will know to do it is very low.

And like I said if you can use the BC's own device detection, and even use the template rendering for the redirection, There is a few ways to do it.

Server side as I stated a bit more is a lot better and your not wrong there.

There is no client side solution that is secure, the best you will have is security through obscurity.

While I'm not objecting to the method if it fits the job, when you say "very low" in terms of users that could get around it you are talking about; you, me, at least 50% of the forum users and anyone that understands HTML. It's low in terms of "the internet" but certainly nothing you would want to protect.

Again, nothing wrong with the solution, you are not wrong, but nothing client side is secure, anyway I'll shutup now until I see the code.

I too could use help in this area. And to Liam, I know you like to not just give the answer outright, but if you have the answer i would appreciate it if you would provide it here if you have it.