Using Cloudflare Geolocation Headers Instead of a Local Database
Applies to SlimStat 6.0.0 and SlimStat Pro 3.0.0 · checked
Choose Cloudflare Header to use location headers on the current request instead of downloading a local GeoIP database. It is available in SlimStat Free 6. Your public site must send visitor requests through Cloudflare and forward the required headers to WordPress.
Configure Cloudflare and SlimStat
Cloudflare’s IP Geolocation setting supplies the country header. Its Add visitor location headers Managed Transform can supply country and additional location fields. See Cloudflare’s IP Geolocation guide and Managed Transforms reference.
- Enable the appropriate location headers in Cloudflare.
- Open SlimStat → Settings → Tracker → Third-party Libraries.
- Set Geolocation Provider → Cloudflare Header and save.
- Use Country precision for country only. Choose City only if you intend to collect the additional available fields and your consent configuration permits them.
No MaxMind key or database download is needed for this provider. Fresh SlimStat installations default to DB-IP, so Cloudflare must be selected explicitly.
Headers and trust
SlimStat requires a nonempty CF-Ray header before reading Cloudflare location headers. Header presence is not authentication. Configure the origin and trusted proxy chain so direct clients cannot impersonate Cloudflare by supplying those headers. SlimStat’s check does not itself verify that the connecting IP belongs to Cloudflare.
| Header | Use |
|---|---|
CF-IPCountry | Validated, lowercased country code |
CF-IPCity | City, when City precision is selected |
CF-Region | Appended to available city information |
CF-IPLatitude, CF-IPLongitude | Coordinates when available at City precision |
CF-Postal-Code, CF-IPContinent | Not stored as pageview columns |
City-level values depend on the supplied headers; selecting City does not guarantee every record has them. Country validation rejects malformed values and the XX placeholder. A missing flag image is not conclusive proof that the country field is empty.
Confirm a new visit
Visit the public proxied hostname from an eligible browser, follow the site’s consent flow and inspect the newest Real-time → Access Log entry. Check Top Countries within the same date range. A direct-origin or staging request without the required headers may have no location.
The tracker performs geolocation only when its PII permission check allows it. Depending on consent settings, an eligible visit can have restricted fields or tracking can be refused entirely. Configure and test consent independently of provider setup.
Limits
Cloudflare Header describes the current request; it cannot resolve an arbitrary IP typed into a lookup tool. Pro 3’s Advanced Whois location lookup requires DB-IP or MaxMind instead. Geolocation is approximate and can reflect a proxy or network location rather than the visitor’s physical location.
Changing providers does not bulk-recalculate stored history. Compare geolocation providers or troubleshoot missing countries.