We have Guest user access / unauthenticated site in Experience / Community Cloud. There is a need to allow request from US and restrict request from all other countries (outside US).

When there is a request to the unauthenticated site in Experience / Community Cloud from US - site page can be displayed. When there is a request to the unauthenticated site in Experience / Community Cloud from Canada or Mexico - site page should not be displayed

Looks like the best option is to use JavaScript to identify the country and take appropriate decision. Are there other options to identify and take action based on the request from countries?

1 Answer 1


You cannot restrict it out of the box in salesforce. Also, any javascript which is relying on IP address based blocking is ineffective because bots and hackers can still use VPN, proxy and other masking methods to access the site.

A good solution is hiding your domain behind a proxy service that essentially handles all the source traffic before forwarding them on to salesforce.

The leader is CloudFlare

Blocking a country couldn’t be easier. Just log in and go to ‘Threat Control’, then where it says ‘Add custom rule’, start typing the full country name and then click it from the dropdown list. Click the big red ‘Block’ button and you’re done!

enter image description here

  • 1
    How does CloudFlare determine the country of origin? If it is via IP address, then you might as well leave out the complexity (and, I assume, cost) of an added "middle man".
    – Moonpie
    Sep 8, 2021 at 1:49
  • The middle man is free. It avoids writing code in salesforce. Plus there is not a 100% guaranteed solution to anything which is public on the internet.
    – Sid
    Sep 8, 2021 at 2:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.