Published
9 MIN READ
Framer Firewall: When to Block a Country on Your Website
The Framer Firewall is the feature, launched on October 1, 2026, that redirects or blocks website visitors by country of origin, by page path or by both together. It's only available with the Advanced Hosting add-on, at US$ 200 per month, or on the Enterprise plan.
Until September, anyone who wanted to block a country on a Framer website had to set up a proxy with Cloudflare. A tutorial from a template studio, published in November 2025, still said the platform had no native geographic restriction. Now it does, and the question has changed: does your website need it, and what does getting the rule wrong cost?
For most companies, the short answer is no. What's already included covers security, and the firewall solves a distribution problem, not a protection one. Before adding the add-on to what goes into the monthly bill of a Framer website, it's worth understanding what it does and where it falls short.
What does the Framer Firewall do?
The firewall applies rules to the published website. Each rule pairs an action with one or two conditions. There are three actions: redirect to another page or address, redirect to another language version of the website, or block, which serves no content at all. The conditions are the visitor's country, the requested path, or both.
According to Framer's help center article on the firewall, updated on October 1, 2026, the path accepts the same patterns as redirects: an exact page (/blog), a page and its subpages (/blog/*), the whole website (/*) and a captured parameter (/blog/:slug). Every condition can be inverted. So "Country Is Not Brasil" applies to everyone outside Brazil.
Rules run in list order, and you change the order by dragging. The setting lives in Site Settings, Hosting, Firewall, and only takes effect after you publish the project. That's why the firewall belongs in the same workflow as who has permission to publish the website: a rule that's saved but not published protects nothing.
What does every Framer website already have at no extra cost?
Every website hosted on Framer already ships with a security layer that doesn't depend on the add-on. Framer's hosting guide, updated on September 30, 2026, lists among the features enabled on all websites TLS encryption, automatically renewed certificates, DDoS protection with rate limiting and automatic challenges, a global web application firewall and a spam filter on forms.
On paid plans, the pricing page also offers password protection for the entire website.
At Wama, websites almost always ship on the Pro plan, and after delivery the client only pays for the Framer plan: hosting, SSL, CDN and security updates are included, with no monthly maintenance contract. That's the starting point for the decision. The add-on doesn't make the website safer against common attacks. It gives you control over who sees what, and from where.
How much does it cost to use the firewall?
The firewall has no price of its own. It comes inside Advanced Hosting, which the Framer pricing page, read on October 2, 2026 with annual billing, lists at US$ 200 per month as an add-on to the Pro plan, which costs US$ 30. On Enterprise, the package is already included. The Basic plan doesn't offer the add-on.
What you want | Where it is | Monthly cost on the official page |
|---|---|---|
Basic security (TLS, DDoS, global firewall, anti-spam) | All websites | Included in the plan |
Entire website behind a password | Paid plans | Included in the plan |
Rules by country or path | Advanced Hosting or Enterprise | US$ 200 on top of Pro |
Your own proxy with Cloudflare | Advanced Hosting or Enterprise | US$ 200 on top of Pro, plus Cloudflare |
Redirect to the right language | Firewall plus localization | US$ 200 plus US$ 20 per language |
The old route also got more expensive. Framer's help article on proxying with Cloudflare, updated on September 30, 2026, states that a reverse proxy only works on Pro with Advanced Hosting or on Enterprise. In practice, both shortcuts to geoblocking go through the same add-on. To see what each Framer plan includes before the add-on, the full breakdown is in another guide.
When it's worth blocking or redirecting visitors by country
The firewall earns its US$ 200 when the rule changes the business, not when it just soothes a generic security worry. Four situations justify the cost:
An offer that's only valid in some countries. A campaign, product or pricing page that can't be seen outside the market where the company operates.
A regulated company with a page for local use. A fintech, for example, may have an account-opening page that only makes sense for people in Brazil. The firewall doesn't replace the website requirements for regulated institutions, but it gets the wrong visitor out of the way.
A website in more than one language. The redirect-to-language action takes visitors from Portugal or the United States straight to the right version. According to the official help article, people already browsing in another language aren't redirected.
A form receiving junk from a specific country. When the default spam filter can't keep up and the unwanted traffic has a clear origin, blocking the contact page for that country solves it without shutting down the website.
Outside these cases, a country rule is usually cost with no return.
Why can blocking the United States take your website out of Google?
Because the firewall treats Google's crawler as a regular visitor from the IP's country, and Googlebot's default addresses show up as being in the United States. The firewall help article says search engines like Googlebot get the same rule as a visitor from that country. Google's documentation on locale-adaptive pages confirms the rest: the crawler uses US IPs by default and should be treated like any user from the country it appears to come from.
The consequence is direct. A rule that says "block everyone outside Brazil" also blocks the US-based Googlebot, and the affected pages can disappear from search. Google also crawls from other countries, but counting on that is betting the website's organic traffic.
With AI assistants, the opposite happens. The official help article warns that country conditions don't apply to AI agents or link-preview bots, such as those from ChatGPT, Slack and Facebook, which fetch the page from data centers. A page blocked for a country stays readable to these agents. For anyone who wants to show up in AI assistant answers, that's good. For anyone who thought the block hid the page, it isn't.
A firewall is not a restricted area
The firewall decides by country and by address. It doesn't know who the person is. That's why it doesn't work for hiding client content, internal material or a negotiated price list: anyone in an allowed country sees the page, and AI agents get past the country rule.
To close off the whole website during a launch, the password protection on paid plans does the job without the add-on. For content that changes depending on who logs in, the problem is a different one. At Wama, logged-in areas and restricted content don't go into a Framer website: they become a digital product project, with a product with login and its own code built to measure.
How to decide whether your website needs the firewall
Four questions settle the decision in a few minutes, before any card goes on the account:
Is there a page that can't be seen in some country? If not, the firewall has no work to do.
Does the website have more than one language with audiences in different countries? If so, language redirection may be worth the cost.
Could the rule hit Googlebot? Any block that includes the United States needs to spare the pages that depend on search.
Is the problem about identity, not geography? If so, the answer is a password or a logged-in area, not a firewall.
The decision belongs to the company, not the vendor. In Wama projects, the website is transferred to the client's account and the subscription is on their card, so any add-on goes on the company's own bill, in dollars, with no markup. If the answer is yes, the rule should be tested before launch, with publishing verified and search monitored over the following weeks.
It's also worth asking whoever manages the website whether they know these traps. It's a good test of how to evaluate who sets up your Framer website.
Frequently asked questions about the Framer Firewall
Does the Framer Firewall work on the Basic plan?
No. The firewall only comes with the Advanced Hosting add-on, which the pricing page offers on the Pro plan, and it's already included in Enterprise. On Basic, security stays at the default layer for all websites: TLS, automatic certificates, DDoS protection, a global firewall and a spam filter on forms.
Can you block a specific IP on Framer?
Not with the firewall launched on October 1, 2026. The official help article describes country and path conditions, with no rule by IP address. Anyone who needs to block specific IPs depends on their own proxy, such as Cloudflare, which also requires Advanced Hosting or the Enterprise plan to work with the website.
Does blocking by country hide the page from ChatGPT?
No. Framer's help center states that country conditions don't apply to AI agents or link-preview bots, which access pages from data centers. A page blocked for visitors from a country stays readable to these agents. To truly hide content, use a password or a logged-in area.
Does the rule take effect as soon as I save it?
No. Firewall rules only apply to the published website, so you need to publish the project after creating, editing or deleting a rule. Since they run in list order, it's worth checking the priority before publishing, because a broad rule at the top can prevent the specific rules below it from being applied.
Do I need the firewall to keep my website secure?
In most cases, no. Framer's hosting guide, updated on September 30, 2026, lists DDoS protection, a global web application firewall, TLS and anti-spam as features enabled on all websites. The Framer Firewall is for deciding who sees which page from where, not for protecting against common attacks.
If your company is deciding how to host a website in Framer and wants to know which rules make sense before paying for them, talk to Wama about your project.
