> For the complete documentation index, see [llms.txt](https://fulbix.gitbook.io/fulbix-fraud-and-ip-blocker/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://fulbix.gitbook.io/fulbix-fraud-and-ip-blocker/setup/fraud-rules-setting-up-blocklist-whitelist-and-redirect-rules.md).
# Fraud Rules: Setting Up Blocklist, Whitelist & Redirect Rules
### What Are Fraud Rules?
Fraud Rules let you create your own custom conditions for handling traffic — on top of the automatic protections covered in earlier articles (VPN/Bot/Persistent Visitor checks). Use Fraud Rules when you know exactly who or where you want to block, allow, or redirect.
Go to Fulbix → Fraud Rules in your Shopify Admin. You'll see four tabs on the left:
| Tab | Purpose |
| --------------- | ----------------------------------------------------------------------------- |
| Blacklist rules | Block specific IP addresses or countries from accessing your store |
| Whitelist rules | Always allow specific IP addresses or countries — bypasses every other check |
| Redirect rules | Send specific IP addresses or countries to a custom URL instead of your store |
| All rules | View, search, and manage every rule you've created, across all three types |
Reminder — evaluation order\
Fulbix checks visitors in this order: Store Access URL → Whitelist → Blacklist → Security checks (Bot/VPN/Persistent Visitor) → Allow. A Whitelist rule always overrides a Blacklist rule for the same visitor.
***
### Two Ways to Define a Rule: IP or Country
Every rule — whether Blacklist, Whitelist, or Redirect — is based on one of two condition types:
| Condition type | What it matches | Best for |
| -------------- | ------------------------------------------------------------------ | ------------------------------------------------------------------------------------- |
| IP-based | One or more specific IP addresses, ranges, or prefixes | Blocking/allowing individual visitors, known bad actors, or your office/warehouse IPs |
| Country-based | One or more countries, or specific regions/states within a country | Blocking/allowing entire geographic markets |
The setup steps below walk through each combination.
***
### Setting Up a Blacklist Rule
Blacklist rules block matching visitors from your store. A blocked visitor sees either your Block Page or is sent to a redirect URL — your choice, set per rule.
#### Step 1 — Open Blacklist rules
1. Go to Fulbix → Fraud Rules.
2. Click the Blacklist rules tab (selected by default).
3. You'll see two condition cards: Blocked IP and Blocked Country, plus a table of All rules already created.
#### Step 2 — Choose a condition type
Click + Add rule under the card that matches what you want to block:
* Blocked IP — block by IP address
* Blocked Country — block by country or region
**Option A: Blocked IP**
| Field | Description |
| ---------------- | ------------------------------------------------------------------------- |
| Rule status | Enable or Disable. Disabled rules are saved but not enforced. |
| Rule name | A short label so you can identify this rule later (required). |
| Note | Optional internal note — e.g. "Repeat chargeback attempts from this IP." |
| Blocking IP type | Choose how the IP value(s) are matched (see table below). |
| IP address(es) | One or more values, added by typing and pressing Enter or clicking + Add. |
Blocking IP type options:
| Type | Format | Example | Matches |
| -------------- | --------------- | ---------------------------- | ----------------------------------------------- |
| Single IP | x.x.x.x | 192.168.1.1 | Exactly that one address |
| CIDR Block | x.x.x.x/n | 192.168.1.0/24 | An entire IP block (256 addresses for /24) |
| IP Range | start – end | 192.168.1.1 to 192.168.1.255 | Every address between start and end (inclusive) |
| IP Starts With | partial address | 192.168 | Any address beginning with that prefix |
Note: Switching the "Blocking IP type" clears any IP values you've already entered for this rule — choose your type first, then add values.
When you're done, the Preview panel on the right shows exactly how the rule will be saved: rule name, status, type, and the list of IP values as chips.
Click Save in the top save bar to create the rule, or Discard to cancel.
**Option B: Blocked Country**
| Field | Description |
| -------------- | ------------------------------------------------------------------------------------------------------------ |
| Rule status | Enable or Disable. |
| Rule name | A short label (required). |
| Note | Optional internal note. |
| Country filter | Choose Specific countries or Specific regions. |
| Add countries | Opens a picker — search and check the countries (or regions/states within a country) to add, then click Add. |
* Specific countries — block entire countries (e.g. block all traffic from a country your store doesn't ship to).
Note: Switching between "Specific countries" and "Specific regions" clears your current selections — pick the filter type first.
Selected countries/regions appear as removable chips. Click the × on a chip to remove it before saving.
Click Save to create the rule.
#### Step 3 — (Optional) Set a Block Action
Blacklist rules use your store's default Block Page automatically. If you'd rather send blocked visitors to a different URL for a specific rule, see Article 9 · Block Page vs. Redirect Page for how block actions and redirect URLs work together.
#### Step 4 — Manage existing Blacklist rules
In the All rules table under the Blacklist tab you can:
| Column | What it shows |
| ------------ | ------------------------------------------------------------------------------------------ |
| Rule name | The name you gave the rule |
| Type | Blocked IP or Blocked Country |
| Value status | A preview of the blocked values (first 3, plus a "+N more" if there are additional values) |
| Status | A toggle switch — turn the rule on/off without deleting it |
| Last Updated | Date and time of the last change |
| Action | Edit (opens the rule in the form, pre-filled) or Delete (with a confirmation prompt) |
***
### Setting Up a Whitelist Rule
Whitelist rules always allow matching visitors — they bypass Blacklist rules and all Security checks (VPN/Proxy, Bot detection, Persistent Visitor Protection). Use Whitelist rules for trusted partners, your own team, payment/shipping integration IPs, or customers who were incorrectly flagged.
#### Step 1 — Open Whitelist rules
1. Go to Fulbix → Fraud Rules.
2. Click the Whitelist rules tab.
3. You'll see two condition cards: Allowed IP and Allowed Country, plus the All rules table for whitelist entries.
#### Step 2 — Choose a condition type
**Option A: Allowed IP**
Click + Add rule under Allowed IP. The form is identical to the Blacklist IP form:
| Field | Description |
| ---------------- | -------------------------------------------------------------------------------------------------------- |
| Rule status | Enable or Disable. |
| Rule name | A short label (required). |
| Note | Optional internal note — e.g. "Office IP — never block." |
| Blocking IP type | Single IP, CIDR Block, IP Range, or IP Starts With (same matching rules as Blacklist — see table above). |
| IP address(es) | One or more values. |
**Option B: Allowed Country**
Click + Add rule under Allowed Country. The form is identical to the Blacklist Country form:
| Field | Description |
| -------------- | --------------------------------------------------- |
| Rule status | Enable or Disable. |
| Rule name | A short label (required). |
| Note | Optional internal note. |
| Country filter | Specific countries or Specific regions. |
| Add countries | Picker to select countries/regions to always allow. |
#### Step 3 — Save and verify
Use the Preview panel to confirm your selections, then click Save.
Important — Whitelist always wins. If an IP or country is in both a Whitelist rule and a Blacklist rule, the visitor is allowed. Use Whitelist rules carefully — they override every other protection in the app, including VPN blocking and Bot detection.
#### Step 4 — Manage existing Whitelist rules
The All rules table under the Whitelist tab works the same as Blacklist: toggle Status on/off, Edit to change values, or Delete with confirmation.
***
### Setting Up a Redirect Rule
Redirect rules send matching visitors to a custom URL instead of your store — with no block page shown. Use these when you want to route certain traffic elsewhere (e.g. a regional landing page, a "coming soon" page for a market you don't yet serve, or an external page for known scrapers) rather than displaying a block message.
#### Step 1 — Open Redirect rules
1. Go to Fulbix → Fraud Rules.
2. Click the Redirect rules tab.
3. You'll see two condition cards: Redirected IP and Redirected Country, plus the All rules table for redirect entries.
#### Step 2 — Choose a condition type
**Option A: Redirected IP**
Click + Add rule under Redirected IP:
| Field | Description |
| ----------------- | ---------------------------------------------------------- |
| Rule status | Enable or Disable. |
| Rule name | A short label (required). |
| Note | Optional internal note. |
| IP condition type | Single IP, CIDR Block, IP Range, or IP Starts With. |
| IP address(es) | One or more values. |
| Redirect URL | Required. The destination URL — must start with https\://. |
**Option B: Redirected Country**
Click + Add rule under Redirected Country:
| Field | Description |
| --------------------------- | ---------------------------------------------------------- |
| Rule status | Enable or Disable. |
| Rule name | A short label (required). |
| Note | Optional internal note. |
| Country filter | Specific countries or Specific regions. |
| Add countries / Add regions | Picker to select which countries/regions to redirect. |
| Redirect URL | Required. The destination URL — must start with https\://. |
Important: Unlike Blacklist rules (where a redirect URL is optional and a Block Page is the default), Redirect rules always require a valid https\:// URL. You cannot save a Redirect rule without one.
#### Step 3 — Save and verify
The Preview panel shows the rule type, status, matched values, and the destination URL in a highlighted box. Click Save to create the rule.
#### Step 4 — Manage existing Redirect rules
The All rules table under the Redirect tab works the same as the other tabs: toggle Status, Edit, or Delete.
***
### Using the "All rules" Tab
The All rules tab gives you a single view across every rule you've created, regardless of type.
| Feature | Description |
| ------------- | ------------------------------------------------------------------------------- |
| Search | Filter rules by name. |
| Kind tabs | Switch between All rules, Blacklist rules, Whitelist rules, and Redirect rules. |
| Kind badge | Color-coded label — red for Blacklist, green for Whitelist, blue for Redirect. |
| Type column | Shows the specific rule type, e.g. Blocked IP, Allowed Country, Redirected IP. |
| Values column | Preview of the IP/country values the rule matches. |
| Status toggle | Enable/disable any rule directly from this table. |
| Last Updated | When the rule was last changed. |
| Delete | Remove the rule permanently (confirmation required). |
This tab is the fastest way to audit all your custom rules at a glance, especially once you have rules across multiple categories.
***
### Editing and Deleting Rules
To edit a rule:
1. Find it in the relevant tab's All rules table (or the global All rules tab).
2. Click Edit. The form opens pre-filled with the rule's current values.
3. Make your changes and click Save in the save bar — or click Discard to cancel without saving.
4. While editing, a Delete rule button appears at the bottom of the form as an alternative to the table's delete action.
To delete a rule:
1. Click Delete next to the rule (from any rules table).
2. Confirm in the dialog — this action cannot be undone.
To temporarily turn a rule off without deleting it, use the Status toggle switch in the table — this is the safest way to "pause" a rule you might need again.
***
### Validation Rules — What's Required to Save
| Rule type | Required fields |
| ------------------- | -------------------------------------------------------------------------------- |
| Blacklist – IP | Rule name, at least one IP value |
| Blacklist – Country | Rule name, at least one country/region |
| Whitelist – IP | Rule name, at least one IP value |
| Whitelist – Country | Rule name, at least one country/region |
| Redirect – IP | Rule name, at least one IP value, Redirect URL (must start with https\://) |
| Redirect – Country | Rule name, at least one country/region, Redirect URL (must start with https\://) |
If a required field is missing, the field is highlighted with an error message and the rule is not saved.
***
### Common Setup Examples
| Goal | How to set it up |
| ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| Block a specific repeat-fraud IP address | Blacklist rules → Blocked IP → Single IP, enter the address, save. |
| Block an entire range of IPs from a known data center | Blacklist rules → Blocked IP → CIDR Block (or IP Range), enter the block/range, save. |
| Stop selling to a country your store doesn't ship to | Blacklist rules → Blocked Country → Specific countries, select the country, save. |
| Always allow your office or warehouse network | Whitelist rules → Allowed IP, enter your office's IP (or CIDR block), save. |
| Un-block a specific customer who was wrongly flagged | Look up their IP in Analytics → Visitors, then create a Whitelist rules → Allowed IP rule for that address. |
| Send visitors from a region you're not ready to serve to a "coming soon" page | Redirect rules → Redirected Country → Specific regions, select the region, set the Redirect URL, save. |
| Send known scraper IP ranges to an external page instead of showing a block message | Redirect rules → Redirected IP → CIDR Block (or IP Starts With), set the Redirect URL, save. |
***
### Important Notes & Warnings
* Whitelist overrides everything. Double-check IP addresses and country selections before saving a Whitelist rule — a mistake here can let unwanted traffic through unchecked.
* Don't accidentally block yourself. Before creating a Blacklist rule with a broad CIDR block or IP range, confirm your own IP address isn't inside it. If you do get locked out, see Article 11 · Troubleshooting → Issue 1 for how to use the Store Access URL to regain access.
* Redirect URLs must be https\://. Plain http\:// URLs are rejected.
* Disabling vs. deleting. If you're not sure whether you'll need a rule again, disable it with the status toggle instead of deleting it — disabled rules are kept but not enforced.
* Country and region lists are independent per rule. Switching a rule's filter type (specific countries ↔ specific regions) clears the current selection, so finish picking your filter type before adding values.
***
### FAQ — Fraud Rules
Q: What's the difference between a Blacklist rule with a Redirect block action and a Redirect rule?
A Blacklist rule's primary purpose is to block — it can optionally send blocked visitors to a redirect URL instead of the Block Page (see Article 9). A Redirect rule is a separate rule type whose only purpose is to route matching traffic to a URL — a redirect URL is mandatory, and there's no block page involved.
***
Q: Can the same IP address be in more than one rule?
Yes, but Whitelist always takes priority over Blacklist and Redirect for the same visitor. If you need predictable behavior, avoid placing the same IP in conflicting rule types.
***
Q: How many rules can I create?
There's no hard limit shown in the interface, but very large rule sets can be harder to manage. Use the All rules tab with search and kind filters to keep track of everything.
***
Q: Where do I find a visitor's IP address or country to use in a rule?
Go to Analytics → Visitors (see Article 3 · Visitor Analytics) — each visitor row shows their IP address and country, along with Quick-Block and Quick-Allow actions that create rules for you automatically
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://fulbix.gitbook.io/fulbix-fraud-and-ip-blocker/setup/fraud-rules-setting-up-blocklist-whitelist-and-redirect-rules.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.