Browser language filter
Every browser tells the site which languages its user prefers, in the Accept-Language header, for example ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7. The language filter works with that header. It helps where the country alone is not enough: a visitor who comes through a VPN in another country usually still has their own language set in the browser.
The filter is part of Geo-blocking: in the site’s settings, Advanced tab, Geo-blocking, section Browser language. Geo-blocking itself has to be on. The language filter needs no GeoIP database.
Modes
| Mode | Effect |
|---|---|
| Off | The browser language is ignored (the default). |
| Denied | Block visitors whose browser asks for any of the selected languages. |
| Allowed | Let in only visitors whose browser asks for at least one of the selected languages. |
The filter reads every language in the header, including the ones after the first. In Denied mode a browser sending en-US,de;q=0.5 is blocked if German is denied. In Allowed mode it gets in if either English or German is allowed.
In Allowed mode the list needs at least one language, because with an empty list nobody could open the site; the panel will not save it. A site can have up to 100 languages.
Languages are picked the same way as countries: type a name or a code, press Enter, and the language appears as a chip.
Languages and regions
A language covers every region it is used in. Picking ru matches ru, ru-RU, ru-BY and ru-KZ; picking pt matches both pt-PT and pt-BR.
To target one region only, type the exact tag, for example en-GB or pt-BR. An exact tag matches only that tag: a rule for pt-BR does not match a visitor who sends plain pt or pt-PT.
Requests without a language
Tick Block visitors that send no language at all to refuse requests with no Accept-Language header (or with nothing usable in it). Every real browser sends this header, while most scripts and many bots do not. The check works together with the Denied or Allowed mode: when the language mode is Off, this check is off too. If you only want this one check, choose Denied and leave the list of languages empty.
How reliable it is
The language header is as easy to fake as the User-Agent: any script can send Accept-Language: en-US. Use the filter as an extra signal next to the country. It keeps out ordinary bots and casual visitors, but someone who targets your site on purpose will get past it.
Visitors blocked by the language filter get the Geo-blocking block page, and addresses in the site’s allow list are exempt.