Location access: control where your account can be used

Location access (in the web vault under Settings, then Security) controls where your account can be used from, based on the country a sign-in appears to come from. It's best-effort, since IP geolocation is approximate.

Choose your location rules

• Off — no location rules at all. Nothing is blocked or challenged because of where you are. This is the default.
• Allow only these countries — only the countries you choose are allowed; sign-ins from anywhere else get the action you pick (Allow, Require 2FA, or Block). When you choose this, your current country is added for you so you don't lock yourself out (you can remove it).
• Block these countries — sign-ins from the countries you choose get the action you pick; everywhere else is allowed.
• Monitor only — nothing is blocked. Sign-ins from outside the countries you choose are recorded in your account activity, so you can see how a rule would behave before you turn it on.

Block Tor connections

Block Tor connections is a separate switch, off by default. When you turn it on, sign-in from the Tor network is stopped whatever your location rules are, including Off. Trusted devices and travel exceptions don't bypass it.

Fine-tune the country rules

• With Allow only these countries or Block these countries, choose how to treat an Unknown location, whether Trusted devices are exempt from country rules, and whether New devices must pass 2FA.
• Set your Home country so it's listed first when you choose countries.
• Pick which actions the rules apply to: sign-in, new-device sign-in, security settings changes, turning 2FA on or off, and trusted device changes.