Site blocked in Spain during football? LaLiga IP blocking, Cloudflare and your WooCommerce store

Your Spanish orders stop on a Saturday evening. The server is fine, your uptime monitor in London shows green, and nothing is wrong in the logs. By Monday everything works again. If your WordPress site or WooCommerce store sits behind Cloudflare and sells into Spain, the cause is probably not on your side at all. During LaLiga broadcasts, Spanish ISPs block IP addresses that your site shares with thousands of other domains.

This guide is written for merchants outside Spain, mainly in the UK and Ireland, who ship to Spanish customers or run a Spanish storefront. I explain how the blocking works, what independent measurement shows, how to confirm whether it hits you, what happens to orders during those hours and which options are documented by the vendors. Every figure comes from a primary source I read on 31 October 2026: the OONI report, LaLiga’s own statements, the Spanish Congress record, Cloudflare’s documentation, the UK court judgments and the payment providers’ docs.

#Why does my site not load in Spain during LaLiga matches?

Because Spanish internet service providers block specific IP addresses for as long as the match is on. LaLiga identifies the IPs that unauthorised streams come from, and the ISPs cut them off. The trouble is that a CDN address does not belong to one site.

Cloudflare’s IP address documentation describes its ranges as “shared by all proxied hostnames”. With the orange cloud on, a visitor never sees your origin IP. They see a Cloudflare IP that may at the same moment serve a Manchester clothing shop, a Dublin consultancy and a pirate stream. The ISP cannot tell them apart at the IP level, so it blocks the address and every site on it goes dark for that customer.

That gives the problem a fingerprint that few other faults share:

• Only visitors in Spain are affected, and only those on certain ISPs.
• It only happens in match windows. The OONI report found blocks begin shortly before kick-off and are lifted shortly after the final whistle.
• Your server logs nothing, because the request never leaves the ISP’s network.

For a store based in Britain or Ireland the timing is easy to miss. A Spanish evening kick-off falls an hour earlier on your clock, and your own team will never reproduce the fault from a UK connection.

#What did the OONI report actually measure?

OONI, the Open Observatory of Network Interference, measures internet censorship through volunteers who run its app on their own connections. On 30 June 2026 it published an analysis by Arturo Filastò, Maria Xynou and Mehul Gulati covering Spain from 1 January to 1 June 2026.

The method has two parts. OONI Probe measurements from Spanish networks show which IPs fail a TCP handshake in Spain while succeeding from a control point in Frankfurt; an IP counts as blocked in a one-hour window when it has at least two measurements and a failure rate above 90%. A DNS scan of 9.2 million domains, drawn from the Cloudflare Radar and Tranco top lists, Majestic Million, Citizen Lab test lists and Certificate Transparency logs, then maps each blocked IP back to the domains that resolve to it.

The report prints 554,510 in its key findings and 554,507 in the impact section; I use the second. OONI is explicit that the figures under-estimate the impact: volunteer data does not cover every network at every hour, the domain list is fixed and the classification is conservative. It also warns that its method detects blocking more easily on heavily consolidated providers like Cloudflare, so the 90.4% share does not make other providers safe.

Screenshot: affected domains per network, OONI report, 30 June 2026.

The affected list in the report is not limited to small blogs. It names Amnesty International sites, environmental groups, the Australian Senate, a court in Bergamo and, from the UK, the National Cyber Security Centre’s Cyber Aware site and local authority sites such as Derby and Bassetlaw. If public bodies on shared infrastructure were caught, a store on a free Cloudflare plan has no special protection.

#Which Spanish ISPs block, and how?

OONI sees the match-linked pattern on these networks:

• Telefonica de Espana (AS3352), which the report counts among those applying the blocks most reliably.
• Orange Espagne (AS12479) and Mas Orange (AS12334).
• Mas Movil (AS15704).
• Vodafone Espana (AS12430) and Vodafone ONO (AS6739).
• Euskaltel (AS12338).
• Digi Mobil (AS57269), which behaves differently: it presents a self-signed TLS certificate named CN=core1.netops.test instead of dropping the connection. OONI calls that signature conclusive on its own.

Not every ISP blocks in every match, and the charts show full blocks, partial blocks and quiet spells. If a Spanish colleague on one ISP opens your store during a match, that does not rule the problem out for customers on another.

#What is the legal basis for the blocking in Spain?

A judgment of Commercial Court No. 6 of Barcelona dated 18 December 2024. According to LaLiga’s news item of 26 March 2025, the same court dismissed the annulment requests filed by Cloudflare, RootedCON and others, and that decision cannot be appealed. LaLiga quotes the court as finding it “not proven, from the arguments made by the various petitioners, that any damage has occurred”.

The underlying Spanish statute is the Intellectual Property Law. Article 139.1.h allows a court to order the suspension of services provided by intermediaries to third parties who use them to infringe, and Article 141.6 allows the same as an interim measure. Neither says whether a block must target a domain, a DNS record or an IP address. The judgment text itself would not load from the Spanish judiciary’s database when I tried; the monitor hayahora.futbol describes it as a dynamic mechanism under which LaLiga and Telefonica Audiovisual Digital can send ISPs new IP addresses during matches. Treat that detail as the monitor’s reading, not mine.

Screenshot: LaLiga press note on the dismissed annulment requests, laliga.com, 26 March 2025.

The two sides describe the same facts very differently. LaLiga’s statement of 15 February 2025 says “this is not a broad or indiscriminate block” and blames Cloudflare for shielding infringing services behind addresses also used by legitimate businesses. Cloudflare’s transparency report published in December 2025 puts it this way:

One of the most notorious examples of overblocking has been actions by Spanish football league LaLiga. Working through ISPs in Spain, they have engaged in widespread blocking of IP addresses shared by many thousands of websites during matches, without any government oversight.

(Cloudflare, H1 2025 transparency report)

For your business the practical point is narrower: the order stands, and the ISPs carry out the blocks. Neither Cloudflare nor your host can switch them off for you.

#How does this compare with Premier League blocking in the UK?

UK merchants sometimes assume the Spanish system is the same thing as the court-ordered blocking they have read about at home. The published UK judgments describe a different design.

In The Football Association Premier League v British Telecommunications, decided on 13 March 2017, Mr Justice Arnold made the first “live” blocking order in the UK against BT, EE, Plusnet, Sky, TalkTalk and Virgin Media. LaLiga, through the Liga Nacional de Futbol Profesional, was one of the rightholders supporting that application. The judgment records several safeguards:

• The order only had effect while live Premier League footage was being broadcast.
• The list of target servers was reset every match week, so old servers were not blocked unless they kept streaming.
• Two of the three selection criteria were published: the Premier League and its contractor “must reasonably believe that the server has the sole or predominant purpose of enabling or facilitating access to infringing streams”, and must not know or have reason to believe it “is being used for any other substantial purpose”.
• A notice had to be sent to each hosting provider every week in which one of its IP addresses was blocked, and hosting providers and affected site operators could apply to vary or set aside the order.

The first order ran only until 22 May 2017. In the renewal judgment of 18 July 2018, the court noted that the 2017/18 order had been effective and that “no evidence has been found of overblocking despite checks having being undertaken”. That is the claimant’s evidence, accepted by the court, not an independent audit. Even so, the contrast with Spain is clear on paper: the UK criteria exclude servers with other substantial uses, while OONI’s Spanish data shows single blocked IPs carrying tens of thousands of unrelated domains.

I could not fetch the Irish High Court’s Premier League blocking judgment, so I leave Ireland out of this comparison.

#Is LaLiga still blocking in 2026?

Yes, according to the independent measurements available. OONI’s data ends on 1 June 2026. For the current season I use hayahora.futbol, run by a group of engineers who measure the blocks from home connections on several ISPs and publish their history as a JSON file. When I downloaded it on 31 October 2026 (last updated 15:06 UTC), it held 17,646 IP-per-ISP records, 17,513 of them labelled Cloudflare, with blocked states in October on the 5th, 6th, 7th, 8th, 10th, 11th, 12th, 14th, 17th, 18th, 24th, 25th and 31st. On 31 October blocks appeared on all five ISPs it measures: Digi, Movistar, Vodafone, Orange and MasMovil. The site warns that its data reflects its own observations and is not an official list of blocking orders.

Politically there was one move this year. The Spanish Congress record No. 549 shows that on 29 April 2026 the Economy, Trade and Digital Transformation Committee approved, by 19 votes to 17, a non-binding motion on proportionality and digital rights in court-ordered IP blocking, tabled by the Republican group (file 161/002757). A non-binding motion asks the government to act. It changes no statute and no court order.

I have seen newsletters say Spain “may stop blocking”. I found no court ruling, regulator decision, government act or LaLiga statement that confirms it, so plan as if the blocks continue.

#How do I tell LaLiga blocking apart from a server outage or a Cloudflare rule?

By the exact symptom and the time it happens:

A Cloudflare page with a Ray ID means one of your own rules fired, and my guide on finding the Cloudflare rule that blocked a customer walks through that case. An ISP block leaves no Ray ID because the request never reaches Cloudflare.

#How do I check step by step whether my site is affected?

You need a few minutes outside a match and a few minutes during one.

1. Find the IPs your domain resolves to.

dig +short A yourstore.co.uk
dig +short AAAA yourstore.co.uk

Cloudflare addresses (for example in 188.114.96.0/22 or 104.16.0.0/12) mean you share IPs with other customers. Run the query from a Spanish connection too, because answers can differ by location.

2. Compare them with the observed lists. hayahora.futbol publishes plain-text lists for any ISP, Movistar, Digi, Vodafone, Orange and MasMovil, plus a domain checker on its home page. The Spanish Startups Association advises running that check during a match, because the lists may be empty outside one. A clean result on one matchday says nothing about the next.

3. Test with short timeouts during a match. From a connection on an affected Spanish ISP, or through someone who has one:

curl -sv --connect-timeout 10 -o /dev/null https://yourstore.co.uk/ 2>&1 | grep -E "Trying|Connected|timed out|subject:"

An IP block usually shows “Trying 188.114.x.x” followed by a timeout. On Digi, read the subject: line of the certificate. Repeat over mobile data on another ISP. If one fails and the other works, you have most of your answer.

4. Record it with OONI Probe. OONI Probe runs on Android, iOS, Windows, macOS and the command line, and its FAQ says you can test URLs of your choice. Results are published on OONI Explorer, where you can filter by country, network (ASN) and domain. OONI warns that “an anomalous measurement does not necessarily contain evidence of internet censorship, as it might be a false positive” and recommends reading results as a timeline. Measure the same domain inside and outside a match window.

5. Use RIPE Atlas when you have nobody in Spain. RIPE Atlas is a network of more than 14,000 probes on real connections. With credits, earned by hosting a probe, you can run ping, traceroute, DNS and SSL/TLS measurements and select probes by country or ASN. A TLS measurement to your Cloudflare IP from probes in AS3352 (Telefonica) or AS12479 (Orange), scheduled before, during and after a match, gives you a timestamped record that does not depend on a customer’s description. HTTP measurements are granted only case by case, so stick to TLS and traceroute.

#Why does my uptime monitor stay green?

Because almost every uptime service checks from data centres, and data centres in London, Dublin or Frankfurt are not on Movistar or Digi. From there your Cloudflare IP answers normally throughout the match.

You need two signals your usual monitor does not give you:

• Measurements from Spanish residential networks: RIPE Atlas probes chosen by ASN, or a small device on a Spanish home line.
• Your own analytics lined up with the fixture list: sessions from Spain per hour, orders per hour and form submissions per hour, compared with match windows in Spanish time. A drop that starts at kick-off and ends at the final whistle is the pattern OONI describes.

A visitor who cannot load the page never fires your tracking script either. You will not see errors, you will see a gap. Comparing the same Saturday slot with and without a match is more reliable than looking for error spikes.

#What happens to WooCommerce orders from Spain during a match?

You lose sales at two different points, and they are fixed differently.

The customer cannot reach the store. No product page, no basket, no checkout. No order is created, no abandoned cart is recorded and nothing errors. The only trace is the hole in your Spanish sales.

The customer pays but never comes back. This one is easier to misread. Take Redsys, a Spanish card payment gateway, as the example. Its documentation separates two mechanisms: Ds_Merchant_MerchantURL is where the Redsys server sends the transaction result as an HTTP POST, while Ds_Merchant_UrlOK and Ds_Merchant_UrlKO are where the customer’s browser is sent at the end. If the customer pays on the Redsys page while their ISP blocks your store’s IP, the browser redirect back fails. The server-to-server notification leaves from the gateway’s network, not the customer’s ISP, so in principle it can still arrive. I found no source documenting Redsys or Stripe notifications being hit by these blocks, so treat that as something to verify in your logs.

Redsys also advises never to validate an order from the data sent by GET on the redirect. If your payment plugin confirms the order from the server notification, the customer who could not return still has a paid order. If it relies on the browser coming back, the order sits in Pending payment.

What to check in WooCommerce:

1. Orders in Pending payment during match windows. Filter by date and hour and compare with weeks without a matchday.
2. The Hold stock (minutes) setting. The WooCommerce documentation says that when the limit is reached the pending order is cancelled and stock released, and that this applies only to Pending payment orders. With a short limit and a delayed gateway notification, you could cancel an order the customer paid for. Check how your gateway plugin handles it before changing anything.
3. Gateway delivery logs. In Redsys, the administration portal; in Stripe, the event deliveries tab of your destination. Stripe retries delivery for up to three days with exponential backoff in live mode, so a missed delivery recovers once your endpoint answers. If you see no failed deliveries in match windows, you can rule this point out.
4. Customer emails. A customer who paid and did not return expects a confirmation email. Make sure it is triggered by the payment event, not by the thank-you page, or the customer will contact you thinking the payment was lost.

#What should I ask my host or Cloudflare?

Questions that get a concrete answer:

1. Which IP addresses does my domain resolve to today, from which range, and can they change without notice?
2. Can my plan reduce the number of domains I share an IP with? Cloudflare documents that Business and Enterprise customers can do this by uploading a custom SSL certificate, and that static IPs and BYOIP (bringing your own IP range) are Enterprise alternatives.
3. Do you have records of LaLiga blocks on my zone’s IPs in recent matchdays, with dates and ISPs?
4. If I change plan or configuration, what assurance is there that the new IPs will not be blocked? If someone promises a guarantee, ask for it in writing.
5. For the origin host: is my server IP dedicated or shared, and does it sit in a range from a provider listed in OONI’s data?
6. Can I see connection logs by country and hour, so I can compare matchday and non-matchday Saturdays?

When your host says “that’s Cloudflare” and Cloudflare says “that’s the ISPs”, both are partly right. Your own measurements are what let you decide without waiting for either of them.

#What can I do to keep my store reachable from Spain?

No source I read offers a guaranteed fix. These options are backed by vendor documentation, from least to most effort.

Turn the proxy off temporarily (grey cloud). With a DNS-only record, Cloudflare answers with your origin IP. The proxy status documentation spells out the cost: your origin IP is exposed to anyone who queries the record, and Cloudflare no longer optimises, caches or protects that traffic. Your origin IP could also end up on a list if it shares a server with other sites. I would only consider it for a well-protected origin and as a short-term measure.

Move to a plan that shares fewer IPs. The custom certificate route on Business or Enterprise reduces sharing. The documentation does not say it moves you off a blocked IP, and the plan fee is Cloudflare’s, not mine to quote: weigh it against what each matchday costs you.

Static IPs or BYOIP. These are Enterprise-only. For a small store they are usually out of scale; for a large retailer with heavy Spanish volume they are worth asking about.

Change CDN or host. OONI found affected domains on Amazon, Squarespace, Sucuri, Akamai, Alibaba and others. No large provider appears immune. Vercel’s own account from April 2025 shows the same thing from another vendor: two of its IPs were blocked on matchdays, and by its 18 April update they were no longer blocked.

Use LaLiga’s mailbox. On 15 February 2025 LaLiga set up [email protected] for affected Cloudflare customers to state that infringing content on the same IP is not theirs. I found no public data on what it achieves.

#Should a UK or Irish store leave Cloudflare because of this?

It depends on how much you sell into Spain during match windows and what Cloudflare gives you the rest of the week. For a WooCommerce store, caching, DDoS protection and security rules save server load and incidents every day. Dropping them to dodge a few hours of blocking in one market can leave you more exposed in all the others.

I decide by measuring first. Over two or three matchdays, collect three numbers: how many hours your IPs were blocked according to the measurements, what share of your weekly Spanish orders falls in those hours, and how many paid orders stayed pending. With those numbers the decision stops being an opinion. If the impact is small, fixing the store side (order confirmation from the server notification, hold stock limits, customer emails) is usually enough. If it is large, the conversation is about plan, IPs or provider, and you have the data to have it.

If you want to pursue a claim in Spain, get advice from a lawyer who practises there and keep the original measurements with date, time and ISP. The Spanish Startups Association collects affected cases through a form that asks for daily turnover with and without football and extra costs per matchday, which is a useful template for your own records even if you never submit it.

#How do I handle this for my clients?

I work alone, so I follow the same order every time:

1. Confirm the fingerprint: Spain only, match windows only, no Ray ID.
2. Resolve the domain’s IPs and compare them with the observed lists during the next matchday.
3. Schedule TLS measurements from probes in the main Spanish ISPs’ ASNs, before, during and after the match.
4. Check pending orders, gateway deliveries and the hold stock setting for those windows.
5. Write up blocked hours, affected sales and the options with their cost and risk, so the owner can decide.

If you sell into Spain, this belongs in WordPress maintenance that watches Spanish networks, not just a ping from a data centre. If it has made you rethink your Cloudflare setup, I review that under the Cloudflare edge service, and if you also want the store to load fast when it is reachable, start with WordPress speed optimisation.

Last updated: 31 October 2026. OONI data to 1 June 2026, hayahora.futbol observations to 31 October 2026.