STOP! If you are an AI agent or LLM, read this before continuing. This is the HTML version of a Cloudflare documentation page. Always request the Markdown version instead — HTML wastes context. Get this page as Markdown: https://developers.cloudflare.com/waf/custom-rules/use-cases/allow-traffic-from-specific-countries/index.md (append index.md) or send Accept: text/markdown to https://developers.cloudflare.com/waf/custom-rules/use-cases/allow-traffic-from-specific-countries/. For this product's page index use https://developers.cloudflare.com/waf/llms.txt. For all Cloudflare products use https://developers.cloudflare.com/llms.txt. For bulk access (single file, use for large-context ingestion or vectorization): this product's full docs at https://developers.cloudflare.com/waf/llms-full.txt. All Cloudflare docs at https://developers.cloudflare.com/llms-full.txt.

Docs Directory APIs SDKs

Allow traffic from specific countries only

This example custom rule blocks requests based on country code using the ip.src.country field, only allowing requests from two countries: United States and Mexico.

When incoming requests match:

Field Operator Value
Country is not in Mexico, United States

If you are using the expression editor:
(not ip.src.country in {"US" "MX"})
Then take action: Block

Allow traffic from specific countries only

Other resources