Show Visitor IP

Description

This plugin simply display Visitor IP Address & visitor location info using by visitor IP on post or page, anywhere using shortcode.

Very simple to install, simple to use, light weight.

External services

The location shortcodes ([svip_location]) need to resolve the visitor IP address into a location. To do that, the plugin sends the visitor IP address to a third party geolocation service over HTTPS. No other data is transmitted, and nothing is sent unless a location shortcode is actually used on the page. Because an IP address is personal data in some jurisdictions (for example under the GDPR), you should mention this in your own privacy policy.

Two services are used, neither of which needs an account or an API key:

1. ipwho.is (primary) – https://ipwhois.io/ – terms: https://ipwhois.io/terms – privacy: https://ipwhois.io/privacy – 1,000 requests per day, commercial use allowed.
2. freeipapi.com (fallback) – https://freeipapi.com/ – terms: https://freeipapi.com/terms – 60 requests per minute, commercial use allowed.

The fallback is only contacted when the primary is unreachable or does not carry the value a shortcode asked for. In practice ipwho.is answers everything except type="currency", which it does not provide, so a page that does not use the currency shortcode never contacts freeipapi.com at all.

Lookups are cached for 12 hours per IP address and shared between all shortcodes on a page, so a returning visitor causes no requests at all.

The plain [show_ip] shortcode does not contact any external service.

Page caching

The output of these shortcodes is different for every visitor. The plugin therefore sets the DONOTCACHEPAGE constant when a shortcode is rendered, which most caching plugins honour, so a page showing an IP address is not stored and served to other people. If your caching setup ignores that constant, exclude those pages from the cache manually.

Sites behind a proxy or CDN

By default only REMOTE_ADDR is used, because the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers can be forged by the visitor. If your site sits behind a reverse proxy, load balancer or CDN that sets those headers, opt in by adding this to wp-config.php:

define( 'SVIP_TRUST_PROXY_HEADERS', true );

Filters

• svip_get_ip – filter the detected IP address.
• svip_trust_proxy_headers – enable or disable the proxy headers.
• svip_providers – reorder, remove or add geolocation services, for example a paid endpoint with an API key. Each entry is an array of url (with %s where the IP goes) and parse (a callback turning the decoded response into the plugin’s field names).
• svip_request_timeout – change the per request timeout, 3 seconds by default.
• svip_cache_lifetime – change how long a location lookup is cached.
• svip_disable_page_cache – return false to stop the plugin setting DONOTCACHEPAGE.