Block pages

By default every blocked visitor gets the same plain 404 Not Found, and a scanner learns nothing from it. A real person, though, sometimes needs to know what happened. A block page lets you show your own text, for example “This shop delivers only in the EU” for Geo-blocking, or “Open this page from our ad” for a link-only landing page.

Which sections have one

Each of these sections has its own block page setting with its own file and status.

Visitors over the rate limit and banned visitors always get the plain 404. Answering a flood has to stay cheap, and a banned scanner would not read the page anyway. Hotlink protection also always answers with the plain 404.

Setting it up

1. Create an HTML page and upload it into the site’s folder, for example errors/blocked.html.
2. In the section’s settings, enter that path in Show file instead of 404 (for Required URL parameters: Show this file).
3. Choose the status: 404, 403 or 200. With 404 (the default) the site looks as if it does not exist, 403 means “forbidden”, and 200 serves the page like any normal one.
4. Save.

The path is relative to the folder the site’s files are served from, and is at most 200 characters long. It must end in .html or .htm. Each part may contain letters, digits, _, - and ., and no part may start with a dot.

If the file does not exist yet, the panel warns you, and blocked visitors get the plain 404 until you upload it.

Make the page self-contained

A blocked visitor cannot load anything else from your site. Requests for your stylesheet, logo or fonts are blocked like the page itself, so the block page has to carry everything it needs:

• styles in a <style> block, not a linked .css file;
• images as inline SVG or data: URIs, or loaded from another domain;
• no scripts from your own site.

A minimal example:

<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Not available</title>
<style>
  body { font-family: system-ui, sans-serif; display: grid; place-items: center; min-height: 100vh; margin: 0; color: #333; }
  main { max-width: 32rem; padding: 1rem; text-align: center; }
</style>
</head>
<body>
<main>
  <h1>Not available in your region</h1>
  <p>This shop delivers only within the European Union.</p>
</main>
</body>
</html>

Caching

Block pages are sent with Cache-Control: no-store and without an ETag. Allowed visitors get the real page at the same address, and this keeps the browser and any cache in between (such as Cloudflare) from storing the block page and showing it to someone else.