=== Not in the EU (Yet) ===
Contributors: site-administrator
Tags: geoblocking, eu, ai-engine
Requires at least: 5.8
Tested up to: 6.7
Requires PHP: 7.4
Stable tag: 1.3.0
License: GPL-2.0-or-later

An independent WordPress add-on that blocks public browser and public REST requests where the web host or CDN identifies the IP address as being in one of the 27 EU member states.

== Installation ==

1. Download `eu-access-blocker.zip`.
2. In WordPress, open Plugins, Add New, Upload Plugin.
3. Upload the ZIP and activate it.

== Important configuration ==

This plugin does not ask a third party to look up visitor IP addresses. It needs one of these server headers supplied by a trusted proxy or host:

* Cloudflare: `CF-IPCountry` (enable IP Geolocation in Cloudflare).
* Vercel: `X-Vercel-IP-Country`.
* Fastly: `Fastly-Client-Country-Code`.
* Amazon CloudFront: `CloudFront-Viewer-Country`.
* Any other trusted proxy: set its header name under Settings, Not in the EU (Yet), "Additional country header".

Configure the origin/proxy so a visitor cannot send or spoof those headers directly. Without a valid header, this plugin allows the request. Test in a private browser session from a known EU and non-EU network before relying on it.

If a full-page cache or CDN cache sits in front of WordPress, make sure it varies its cache by the country header (or is bypassed for this check) so a cached response from one visitor is never served to a visitor in a different country.

The default list is the 27 EU member states. EEA-only countries (Iceland, Liechtenstein and Norway), the United Kingdom, and other territories are not blocked unless a developer adds them using the `eu_access_blocker_countries` WordPress filter.

== Scope ==

The block applies to the public site and REST requests. WordPress administration, AJAX, cron, and WP-CLI are left available so administrators can manage the site.

== Visitor message ==

After activation, open Settings, Not in the EU (Yet). Select one of three editable starting messages: a formal legal notice, a message critical of disproportionate bureaucracy, or a "coming soon" notice. The message editor accepts basic HTML.

== Card appearance ==

Three optional settings shape the page shown to a blocked visitor:

* Site logo: show the site's custom logo (or site name, if none is set) above the message.
* Custom HTML card: replace the preset/message with your own HTML, shown as-is instead of the built-in wording.
* Opaque background: render the card on a solid dark backdrop instead of plain text on a white page.

== Legal note ==

Geoblocking is a technical access-control measure, not a determination of legal obligations or compliance. Obtain appropriate legal advice for the service and jurisdictions involved.
