A blunt instrument.
WHY PEOPLE DO IT
Attack traffic concentrated in particular regions A business serving only one country
WHAT IT BLOCKS THAT YOU DID NOT INTEND
Legitimate visitors travelling Customers using a VPN, which is common Search engine crawlers, which are hosted in various places Monitoring services Payment gateway callbacks, if the gateway's infrastructure is elsewhere You, when travelling
THE GATEWAY POINT
A country block preventing your payment gateway confirming transactions means orders stay unpaid.
Allow the gateway explicitly before blocking anything broadly.
A BETTER APPROACH
Challenge rather than block. A legitimate visitor passes; automated traffic does not.
Or restrict the rule to sensitive paths: challenge requests to the login page from outside your country, while leaving the public site open.
That gets most of the benefit with almost none of the cost.
WHEN A BLOCK IS JUSTIFIED
Sustained attack from a region with no plausible legitimate traffic, as a temporary measure.
Review it afterwards rather than leaving it indefinitely.
TESTING
Confirm search engine crawlers and your gateway still reach you.
