How Logify Determines IP Address and Country

What is it?

Every activity Logify records carries the IP address it came from, and where possible the country that IP belongs to. The country appears as a flag and label in the Activity Logs and User Sessions screens, and drives the Top Countries card on the PRO dashboard.

Country lookup is resolved in the background, after the log entry has already been saved, so it never slows down the page that triggered the event.

Why is it helpful?

An IP address on its own rarely tells you anything. A country does. An administrator signing in from a country your team has never worked from is worth a second look, and a burst of failed logins from one place is a different problem from a burst spread across many.

Country data lets you:

Spot logins from unexpected places on the User Sessions screen.
See where your traffic and your risk come from on the dashboard's Top Countries card.
Give context to failed logins when reviewing a suspicious period.

How Logify resolves a country

Logify tries the cheapest and most private option first, and only reaches outside your site as a last resort.

1. A country header from your CDN (off by default)

If your site sits behind Cloudflare, CloudFront, or a similar proxy, that service may already have resolved the country and passed it along in a request header. Logify can use it, but does not by default — request headers can be spoofed by whoever is making the request unless a trusted proxy is guaranteed to set them.

Turn it on only if you know your proxy always sets the header:

add_filter( 'kc_lf_trust_country_headers', '__return_true' );

2. A local GeoIP database

If a MaxMind GeoLite2 country database is available on the server, Logify reads it directly. Nothing leaves your site and there is no rate limit.

By default Logify looks for GeoLite2-Country.mmdb in its uploads directory. You can point it elsewhere:

add_filter( 'kc_lf_geoip_database_path', function () {
    return '/full/path/to/GeoLite2-Country.mmdb';
} );

This is the recommended setup for privacy-sensitive sites and for sites with a lot of traffic.

3. An online lookup service

If neither of the above produced a country, Logify asks an external service — ipapi.co first, falling back to ipwho.is if it does not answer.

Only the IP address is sent. Private, reserved, and local addresses are never sent. Results are cached for 7 days, and a failed lookup is cached briefly so a provider outage does not cause repeated requests. Only one uncached lookup runs at a time, so a cache expiry cannot turn into a flood of requests.

How to use it

Step 1: See country data in the logs

Go to Logify > Activity Logs. The IP Address column shows the country flag and name next to the address once it has been resolved.

Step 2: Review sessions by location

Go to Logify > User Sessions. The IP / Country column shows where each login session is coming from. See How to Monitor Logged-In Users & Terminate Inactive Sessions.

Step 3: Watch the trend (PRO)

The Top Countries card on the Logify dashboard ranks the countries generating the most activity. See What You Learn From The Logify Analytics Dashboard.

Turning external lookups off

If you do not want Logify contacting an outside service at all, you have two options:

Install a local GeoIP database (step 2 above). Logify will find the country locally and never make an external request.
Return no lookup URLs, which disables the online step entirely:

add_filter( 'kc_lf_country_lookup_urls', '__return_empty_array' );

Country values will simply stay empty for addresses that cannot be resolved locally.

Filters reference

Filter	Purpose
`kc_lf_trust_country_headers`	Trust a CDN-supplied country header. Off by default.
`kc_lf_geoip_database_path`	Path to a local MaxMind GeoLite2 country database.
`kc_lf_country_lookup_urls`	The list of online lookup endpoints, in order. Return an empty array to disable.
`kc_lf_country_lookup_timeout`	Timeout for an online lookup request.
`kc_lf_country_negative_cache_ttl`	How long a failed lookup is remembered before retrying.
`kc_lf_trust_proxy_headers`	Whether to read the client IP from proxy headers.

Frequently asked questions

Why is the country empty for some entries? Local and private addresses are never looked up, so anything from 127.0.0.1 or a LAN address has no country. A lookup may also have failed, in which case it is retried later.

Is the IP address sent anywhere else? No. The only outbound use is the country lookup described above, and only when the country could not be determined locally.

Can I hide IP addresses from the logs screen? Yes — see Data Privacy, Anonymisation and Log Retention.

Does country lookup slow down my site? No. It runs in a background task after the entry is saved, so the request that triggered the event never waits for it.