Framer guide
Cloudflare geoblocking on a Framer site: what actually works
"Use Cloudflare" is the standard answer for blocking countries, and on a Framer site it does work, with caveats most answers skip. Here's the real setup, where it bites, and when a plugin is the simpler tool.
The Cloudflare setup, honestly
- Move your domain's DNS to Cloudflare. Create a free account, add the site, and switch nameservers at your registrar. Propagation can take up to a day.
- Point the domain at Framer per Framer's custom-domain instructions, with records set to Proxied (orange cloud). This is the catch, see below.
- Add a WAF custom rule: Security → WAF → Custom rules → field Country, operator equals, action Block. See Cloudflare's docs.
The three catches on Framer
1. WAF needs the proxy Framer tells you to turn off
Cloudflare's firewall only filters proxied traffic. But Framer's custom-domain guidance recommends DNS-only (grey cloud) mode, because proxying in front of Framer's SSL and redirects is a known source of certificate errors and redirect loops. You can make proxied mode work, but you're then maintaining a setup Framer doesn't support if it breaks.
2. Blocked visitors get a Cloudflare error page
A blocked visitor sees Cloudflare's generic 1020/403 screen: Cloudflare branding, error codes, no explanation. Custom block pages are a paid Cloudflare feature. If that visitor is a client or partner, that's the impression they get.
3. It's all-or-nothing, domain-wide
The rule blocks the entire domain. You can't block only a pricing page or a gated section, and every change means a second dashboard your Framer workflow never touches.
The alternative: block inside Framer
Bouncer does the same job at the site layer: each visitor is checked server-side on load, and blocked countries see an access screen styled to match your site. No DNS migration, no proxy, nothing for Framer support to disown. It also does what Cloudflare's free plan doesn't: VPN and proxy detection, per-page rules, and allowlist mode. Here's the difference a blocked visitor sees:
Access unavailable
Sorry, this content isn't available from your location.
Back to homeCloudflare vs. a plugin
| Cloudflare (free) | Plugin (Bouncer) | |
|---|---|---|
| DNS / nameserver changes | Required | None |
| Works with Framer's recommended DNS | No (needs proxy on) | Yes |
| Block page matches your site | Paid only (generic error) | Yes |
| Per-page / per-section rules | Domain-wide only | Yes |
| VPN / proxy detection | Not on free plan | Yes (Pro) |
| Edge DDoS / firewall | Yes | No |
| Setup time | ~1 hour + DNS wait | ~2 minutes |
When Cloudflare is still the right call: your DNS already lives there with the proxy on and stable, you want blocking at the network edge before a byte reaches Framer, or you're using it for DDoS/WAF anyway. Otherwise the plugin route is less machinery for the same result.
Common questions
Does Cloudflare blocking work in DNS-only mode?
No. WAF rules only apply to proxied (orange-cloud) traffic. In DNS-only mode Cloudflare never sees the request, so it can't block it.
Can I keep Cloudflare and just skip the proxy?
You can use Cloudflare for DNS in grey-cloud mode, but then its country blocking doesn't run, you'd need a plugin for the blocking itself.
Is the plugin slower than edge blocking?
The plugin adds one fast server-side lookup at load; visitors don't notice it. Cloudflare blocks slightly earlier (at the edge), which matters for DDoS but not for a normal country rule.
Sources: Cloudflare WAF custom rules · Framer custom-domain help.