WPLocation – Geolocation and Country Rules

Country data, privacy and safe upgrades

Local country lookup needs a current, licensed GeoLite2 Country MMDB. Separately installed, trusted country-source adapters may provide a verified country through the extension hook; their infrastructure and privacy requirements are documented by that adapter. No visitor-country service or paid account is required by Free itself. It does not bundle location data. You can select a private server file or use your own MaxMind account ID and license key to download one from Settings. Automatic updates are opt in and off by default. When enabled, the updater contacts MaxMind for an authorized download and follows its signed Cloudflare R2 file URL. The providers receive your site’s server IP and MaxMind receives the account credentials. Visitor IPs remain on your server during local lookups and are not sent by the updater. See https://dev.maxmind.com/geoip/geolite2-free-geolocation-data/, https://www.maxmind.com/en/geolite/eula, https://www.maxmind.com/en/privacy-policy and https://www.cloudflare.com/privacypolicy/.

Saved MaxMind credentials are non-autoloaded WordPress options, not encrypted at rest; they may appear in database backups. For stronger secret management, define WPLOCATION_MAXMIND_ACCOUNT_ID and WPLOCATION_MAXMIND_LICENSE_KEY in wp-config.php. Those constants take priority. The plugin does not display saved keys or record them in its activity log.

Store the MMDB outside the public web root. Automatic updates save validated copies beside the configured source, select them atomically and retain the last working file on failure. Recorded unchanged retired copies can be removed after two days; configured and untracked files remain the site’s responsibility. WordPress cron needs traffic or a server cron. Follow MaxMind’s database update and deletion requirements. This product can use GeoLite Data created by MaxMind, available from https://www.maxmind.com/.

Geolocation is approximate and these rules are for personalization, not access control for confidential content. When a country cannot be determined, restricted content is hidden. Caches and CDNs can serve the wrong country or bypass WordPress altogether. While Free is active, the plugin requests no-store responses for frontend HTML and country-aware post, page and search REST reads because targeted content can appear in posts, blocks and secondary queries. It purges WP Super Cache when its API is present, but you must configure and test any shared cache. Forwarded IP headers are not trusted by default; verified infrastructure can provide an address with the wplocation_verified_client_ip filter.

Upgrading an older standalone build requires a current country source. A database stored inside the old plugin folder is removed by WordPress’s replacement flow; this release does not bundle, restore or silently copy obsolete location data. Before updating, back up the site and rules, prepare a current licensed GeoLite2 Country MMDB outside the plugin folder and public web root, and select it with the documented upgrade preparation tool or configuration constant. Existing private database settings and audience storage keys are retained. Without a readable source, country-restricted output stays hidden and the dashboard provides recovery steps. Purge and test every external page or CDN cache after updating.

For older content, standard post and text-widget rendering translates [locationtarget] markup to [wplocation_target] before WordPress processes shortcodes. This does not register the unprefixed legacy shortcode and does not edit saved posts or revisions. Escaped examples are preserved; another plugin that registers the old tag keeps ownership. Use the prefixed shortcode for new content. Page-builder metadata, custom fields and direct do_shortcode() integrations need a separate review and conversion. Private database settings and content are per site on multisite; prepare and verify every site before a network update.

The combined plugin is GPLv3 or later and contains third-party libraries under their own licenses, including Apache-2.0 MaxMind libraries. See THIRD-PARTY-NOTICES.txt and vendor license files.