About this plugin
WPLocation is a country visibility plugin for WordPress. Set an audience for posts, pages or categories, use the country visibility block or [wplocation_target] shortcode, and display a detected country with [wplocation_country]. The admin menu includes Settings, Diagnostics and a private activity log.
Pro and optional add-ons are distributed separately; no paid feature code is bundled or locked inside this plugin. 3.
The plugin needs a current, licensed GeoLite2 Country MMDB. It does not bundle location data. You can select a private server file or use your own MaxMind account ID and license key to download one from Settings.
Automatic updates are opt in and off by default. When enabled, the updater contacts MaxMind for an authorized download and follows its signed Cloudflare R2 file URL. The providers receive your site’s server IP and MaxMind receives the account credentials.
Visitor IPs remain on your server during local lookups and are not sent by the updater. com/privacypolicy/.
Saved MaxMind credentials are non-autoloaded WordPress options, not encrypted at rest; they may appear in database backups. php. Those constants take priority.
The plugin does not display saved keys or record them in its activity log.
Store the MMDB outside the public web root. Automatic updates save validated copies beside the configured source, select them atomically and retain the last working file on failure. Recorded unchanged retired copies can be removed after two days; configured and untracked files remain the site’s responsibility.
WordPress cron needs traffic or a server cron. Follow MaxMind’s database update and deletion requirements. com/.
Geolocation is approximate and these rules are for personalization, not access control for confidential content. When a country cannot be determined, restricted content is hidden. Caches and CDNs can serve the wrong country or bypass WordPress altogether.
While Free is active, the plugin requests no-store responses for frontend HTML and country-aware post, page and search REST reads because targeted content can appear in posts, blocks and secondary queries. It purges WP Super Cache when its API is present, but you must configure and test any shared cache. Forwarded IP headers are not trusted by default; verified infrastructure can provide an address with the wplocation_verified_client_ip filter.
0 plugin cannot be replaced safely without preparation: its old bundled database disappears when WordPress replaces the plugin folder, and that database is outdated. 0 installations. Do not manually overwrite the old plugin.
Back up the site and rules, prepare a current licensed database outside the old plugin folder, deactivate and remove the old plugin, then install this release. Replace legacy [locationtarget] shortcodes with [wplocation_target] in content before removing the old plugin. The legacy settings use the same option names, so review and test every rule after migrating.
0 requires a separate, tested upgrade path.
0 MaxMind libraries. txt and vendor license files.