How to block a country on Shopify (2026 guide)

"Block a country" turns out to mean four different things, and picking the wrong one is why merchants install an app they did not need, or install nothing and stay exposed. Two of the four are built into Shopify and cost nothing. Start there.

Method 1: shipping zones (stop shipping there)

The simplest lever. If a country is not in any shipping zone, no shipping rate exists for it, and checkout cannot complete.

1. In your Shopify admin, go to Settings then Shipping and delivery.
2. Open the shipping profile you use (usually General shipping rates).
3. Find the zone containing the country and remove it, or edit the zone so the country is not selected.
4. Save, then test with a cart and that country's address at checkout.

Method 2: Shopify Markets (stop selling there)

Markets is the native way to control which countries can actually buy from you. A country that is not in an active market cannot complete checkout, regardless of shipping setup.

1. Go to Settings then Markets.
2. Review which markets are active and which countries each one includes. Many stores have a broad catch-all market and never look at it again.
3. Remove the country from its market, or deactivate the market entirely if it exists only to serve that region.
4. Save and test. A shopper who switches to that country in your storefront picker should no longer be able to check out.

Method 3: an app (stop them reaching the store)

Neither native option stops anyone from loading your storefront. If the problem is scraping, bot traffic, fraud reconnaissance, or ad-budget waste, the damage happens on the page view itself and nothing at checkout can help. Shopify has no built-in setting for this, so an app is the only route.

Using Cordon as the example, the whole setup is three steps:

1. Install and enable the app embed. After installing, the Setup screen walks you through it: open the theme editor, switch on the Cordon Block & Protect app embed, and save. This is what lets the app see visitors at all, so nothing works until it is on.
2. Add a country rule. Open the Rules page and use Block by country. Search and add countries individually, or apply a preset such as Block China or Block high-risk countries. Changes stay a draft until you hit Save, so you can stage a whole policy and apply it in one go.
3. Check the logs. The Logs page shows each visitor's country, network, and which rule fired. Watch it for a day: this is how you catch a rule that is broader than you meant.

What about the Liquid code snippets?

Search this topic and you will find blogs recommending you paste a snippet into theme.liquid that checks localization.country and redirects. Do not use it. That property is Shopify's own term for the country selected in your storefront's country picker, not the visitor's detected location. A visitor changes it in one click, the redirect runs after the page has already been delivered, and branching Liquid on a per-visitor value breaks Shopify's CDN caching so the block fires on the wrong people at random.

We took that snippet apart line by line in why localization.country is not geolocation, with the relevant Shopify documentation. The short version: it is not a weak lock, it is not a lock.

Before you go live: three checks

1. Do not block search engines. Googlebot crawls from datacenter IP ranges worldwide. Any tool you use must exempt verified crawlers by reverse DNS, not by trusting a user-agent string. Get this wrong and you deindex the store.
2. Check your own traffic first. Look at analytics before writing rules. Blocking a country that quietly sends you 4% of revenue is an expensive way to stop a scraper.
3. Confirm it fails open. This code runs on every page load. If the vendor's service goes down, visitors must be allowed through by default, not blocked. Ask, because not every app does this.

For a fuller merchant-side walkthrough there is a step-by-step country blocking guide, and a guide to geo-restricting a store to specific countries if your requirement is an allowlist ("only these five countries") rather than a blocklist. If you want the architecture behind all of this, the four layers you can block Shopify traffic at explains why the native options stop where they do.