Set up CloudFront Country Source

This guide connects CloudFront’s country and viewer-address headers to WPLocation without a MaxMind account or a per-visitor WPLocation API call. It does not create a CloudFront distribution or access your AWS account.

1. Install Free and the add-on

1. Install WPLocation Free 1.1.7 and confirm the site’s country rules. Pro 1.4.0+ is optional.
2. Download the free CloudFront Country Source ZIP, then install under Plugins → Add New → Upload Plugin and activate.
3. Open WPLocation → CloudFront Source. Leave the source disabled while configuring CloudFront.

2. Create the private origin token

1. On the CloudFront Source page choose Generate token. Copy the 64-character hexadecimal value now; WordPress saves only a hash and cannot show it again.
2. In your distribution’s WordPress origin, add a custom origin header named X-WPLocation-Origin-Token with that exact value. CloudFront overwrites a viewer-supplied header of the same name before sending the origin request. Keep the value private and rotate it if exposed.
3. Save the WordPress settings with the token but leave Enable CloudFront country lookup unchecked until the policy is deployed.

See AWS custom origin header documentation.

3. Forward both viewer headers

For the behavior serving WordPress, configure an origin request policy that forwards CloudFront-Viewer-Country and CloudFront-Viewer-Address. The latter is needed even when the country header is present: it lets Free use the real visitor IP for optional local fallback instead of the CloudFront edge address. The country must be a known two-letter code. See AWS viewer header documentation.

4. Make the cache country-safe

CloudFront may return cached HTML without contacting WordPress. For pages with country-dependent content, use a cache policy that does not publicly cache the HTML, or includes the viewer country in its cache key. Never publicly cache account, cart or checkout responses. Other page caches between CloudFront and WordPress need an equivalent bypass or country variation. See AWS cache key guidance. WPLocation requests no-store for targeted output, but that cannot repair a response already served from a CDN cache.

5. Enable and test the real path

1. After the distribution policy deploys, return through the CloudFront hostname to WPLocation → CloudFront Source. Confirm the origin token reads Verified, viewer address Valid and country header shows a known country.
2. Check a country-targeted page through CloudFront from at least two countries or controlled test locations. Verify allowed and denied views and a Pro rule if Pro is active. Repeat after clearing the CDN and page caches.
3. Visit the origin directly without CloudFront. It should show Not verified, and a forged country header must not drive a country decision. Restrict direct-origin network access when practical.
4. Remove or invalidate the country header in a controlled environment. With a current local MMDB and verified viewer address, Free should fall back to local lookup; without either source, country-targeted content follows the unknown-country behavior.

Diagnostics for a manually entered IP intentionally use the configured local MMDB, because CloudFront headers describe only the current visitor. For the current request, use the CloudFront Source status panel. No live AWS distribution was part of WPLocation’s isolated release tests; each site owner must verify their own origin and cache policy.

Privacy and maintenance

The add-on makes no outbound HTTP request and stores only the SHA-256 token hash and enabled setting. CloudFront and your hosting provider still process network information under their own terms. The optional local MMDB has its own license and maintenance requirements. To rotate the token, generate a new value, update CloudFront’s custom origin header, then save the new value in WordPress; allow for policy propagation and test immediately. Turning the source off retains saved settings and local data. IP geolocation is approximate and is not an authorization boundary.