How Logify Determines IP Address and Country

Q: Can I hide IP addresses from the logs screen?

Yes. Set Data Anonymization under Logify Settings General to Anonymise Only IP to mask the address (for example 192.168.1.xxx), or Anonymise All Data to hide the country as well. See Data Privacy, Anonymisation and Log Retention for the full behaviour and how it affects exports.

An IP address alone rarely tells you much, but the country behind it does — an admin login from a country your team has never worked from is worth a second look. Logify records the IP address on every WordPress activity and resolves its country in the background, so the page that triggered the event is never slowed down. Country lookup is a free feature: Logify resolves it from a trusted CDN header, a local MaxMind GeoIP database, or an online service (ipapi.co with an ipwho.is fallback), in that order of preference.

What is IP and country tracking?

Every activity Logify records carries the IP address it came from, and where possible the country that IP belongs to. The country appears as a flag and label in the Activity Logs and User Sessions screens, and drives the Top Countries card on the PRO dashboard.

Country lookup is resolved in the background, after the log entry has already been saved, so it never slows down the page that triggered the event.

Why is it helpful?

An IP address on its own rarely tells you anything. A country does. An administrator signing in from a country your team has never worked from is worth a second look, and a burst of failed logins from one place is a different problem from a burst spread across many.

Country data lets you:

Spot logins from unexpected places on the User Sessions screen.
See where your traffic and your risk come from on the dashboard's Top Countries card.
Give context to failed logins when reviewing a suspicious period.

How Logify resolves a country

Logify tries the cheapest and most private option first, and only reaches outside your site as a last resort.

1. A country header from your CDN (off by default)

If your site sits behind Cloudflare, CloudFront, or a similar proxy, that service may already have resolved the country and passed it along in a request header. Logify can use it, but does not by default — request headers can be spoofed by whoever is making the request unless a trusted proxy is guaranteed to set them.

Turn it on only if you know your proxy always sets the header:

add_filter( 'kc_lf_trust_country_headers', '__return_true' );

2. A local GeoIP database

If a MaxMind GeoLite2 country database is available on the server, Logify reads it directly. Nothing leaves your site and there is no rate limit.

By default Logify looks for GeoLite2-Country.mmdb in its uploads directory. You can point it elsewhere:

add_filter( 'kc_lf_geoip_database_path', function () {
    return '/full/path/to/GeoLite2-Country.mmdb';
} );

This is the recommended setup for privacy-sensitive sites and for sites with a lot of traffic.

3. An online lookup service

If neither of the above produced a country, Logify asks an external service — ipapi.co first, falling back to ipwho.is if it does not answer.

Only the IP address is sent. Private, reserved, and local addresses are never sent. Results are cached for 7 days, and a failed lookup is cached briefly so a provider outage does not cause repeated requests. Only one uncached lookup runs at a time, so a cache expiry cannot turn into a flood of requests.

How to use it

Step 1: See country data in the logs

Go to Logify > Activity Logs. The IP Address column shows the country flag and name next to the address once it has been resolved.

Step 2: Review sessions by location

Go to Logify > User Sessions. The IP / Country column shows where each login session is coming from. See How to Monitor Logged-In Users & Terminate Inactive Sessions.

Step 3: Watch the trend (PRO)

The Top Countries card on the Logify dashboard ranks the countries generating the most activity. See What You Learn From The Logify Analytics Dashboard.

Turning external lookups off

If you do not want Logify contacting an outside service at all, you have two options:

Install a local GeoIP database (step 2 above). Logify will find the country locally and never make an external request.
Return no lookup URLs, which disables the online step entirely:

add_filter( 'kc_lf_country_lookup_urls', '__return_empty_array' );

Country values will simply stay empty for addresses that cannot be resolved locally.

Filters reference

Filter	Purpose
`kc_lf_trust_country_headers`	Trust a CDN-supplied country header. Off by default.
`kc_lf_geoip_database_path`	Path to a local MaxMind GeoLite2 country database.
`kc_lf_country_lookup_urls`	The list of online lookup endpoints, in order. Return an empty array to disable.
`kc_lf_country_lookup_timeout`	Timeout for an online lookup request.
`kc_lf_country_negative_cache_ttl`	How long a failed lookup is remembered before retrying.
`kc_lf_trust_proxy_headers`	Whether to read the client IP from proxy headers.

Conclusion

Logify enriches every logged IP with its country so you can spot logins from unexpected places and add context to failed logins — all resolved in the background so nothing slows down. Country lookup is free and private by design: it prefers a local database and only reaches an external service as a last resort, and you can switch that off entirely. To keep IP addresses off the screen for reviewers, or to stop recording them altogether, see Data Privacy, Anonymisation and Log Retention.

FAQs

Why is the country empty for some entries?

Local, private, and reserved addresses are never looked up, so anything from 127.0.0.1 or a LAN address such as 192.168.x.x has no country. A lookup can also fail if no local database is present and the online services do not answer; failures are cached briefly and retried later, so an empty country may fill in on a subsequent activity.

Is the IP address sent anywhere else?

No. The only outbound use of an IP is the country lookup, and only when the country could not be determined from a CDN header or a local database first. Only the IP is sent — never usernames or other log data — and private and reserved addresses are never sent. Installing a local GeoIP database, or returning an empty array from kc_lf_country_lookup_urls, stops all external requests.

Can I hide IP addresses from the logs screen?

Yes. Set Data Anonymization under Logify > Settings > General to Anonymise Only IP to mask the address (for example 192.168.1.xxx), or Anonymise All Data to hide the country as well. See Data Privacy, Anonymisation and Log Retention for the full behaviour and how it affects exports.

Does country lookup slow down my site?

No. Country resolution runs in a background task after the log entry is already saved, so the request that triggered the event never waits for it. Only one uncached lookup runs at a time and results are cached for seven days, so even a busy site never floods an external provider with requests.

Is IP and country tracking a PRO feature?

No. Recording the IP address and resolving its country is part of free Logify, including the local MaxMind database option and the online fallback. Only the Top Countries dashboard card, which ranks activity by country over time, is a Logify PRO analytics feature.