=== WPLocation CloudFront Country Source ===
Contributors: wplocation
Tags: geolocation, cloudfront, country, cdn
Requires at least: 6.8
Requires PHP: 8.3
Tested up to: 7.1
Stable tag: 1.0.1
License: GPLv3 or later
License URI: https://www.gnu.org/licenses/gpl-3.0.html

Use Amazon CloudFront viewer-country data as an optional WPLocation source without per-visitor WPLocation API calls.

== Description ==

This free, separate add-on requires WPLocation Free 1.1.5 or newer. WPLocation Pro 1.4.0 or newer also consumes its country choice through Free. The add-on does not require a MaxMind account, WPLocation credits, an AWS API key or a paid WPLocation license. It makes no outbound requests to AWS. Your site must already be served through your own CloudFront distribution.

In the distribution's origin configuration, create a custom header named X-WPLocation-Origin-Token with a 64-character hexadecimal value generated in the add-on settings. CloudFront overwrites a viewer-supplied copy before forwarding the request. The add-on stores only the SHA-256 hash of the token. Add CloudFront-Viewer-Country and CloudFront-Viewer-Address to the WordPress behavior's origin request policy. The first provides the two-letter country code; the second supplies the actual viewer IP for a correct local-database fallback. If the trusted token or viewer address is unavailable, the add-on does not trust the country header.

Use the WPLocation > CloudFront Source admin page to save the token and explicitly enable the source. Its status panel checks the current admin request. Test from a page served through CloudFront and by visiting the origin directly. A valid CloudFront request should show a verified token, viewer address and country. A direct-origin or spoofed request should not use the country header. Keep personalized HTML uncached or include the country header in the CloudFront cache key. Exclude checkout and account pages from public caching. A cache can respond before WordPress runs, so plugin checks alone cannot establish CDN correctness.

If the country header is absent or invalid but a trusted viewer address is present, Free falls back to its configured local GeoLite2 Country MMDB. If the viewer address is missing, the detected country is unknown rather than the CloudFront edge location. Existing rules and local data are retained when the add-on is disabled. IP geolocation remains approximate and is not access control for confidential content.

See https://wplocation.com/documentation/cloudfront-country-source/ for setup and verification. This is a WPLocation integration for Amazon CloudFront, not an official AWS partnership.

== Installation ==

1. Install WPLocation Free 1.1.5 or newer. Pro 1.4.0 or newer is optional.
2. Install and activate this add-on ZIP.
3. Generate a token in WPLocation > CloudFront Source, copy it to a CloudFront custom origin header and save the settings.
4. Forward both CloudFront viewer headers to the WordPress origin, enable the source, then test the status panel and country-specific pages.

== Changelog ==

= 1.0.1 =
* Report the enabled CloudFront source and current origin/viewer checks to WPLocation Free 1.1.6 Overview and Diagnostics, so a site using no local MMDB does not appear unconfigured.

= 1.0.0 =
* First release. Verified CloudFront origin token, country header and viewer address feed Free and Pro with local fallback and no outgoing lookup request.
* Added an administrator setup and status page with token generation and safe rotation.

== Compatibility ==

Tested in isolation with WordPress 6.8.3 and 7.1.3, PHP 8.3, WPLocation Free 1.1.5-1.1.6 and Pro 1.4.0-1.4.1. CloudFront distribution policy, origin firewall, cache behavior and custom host variations must be tested on each site. A live AWS CloudFront distribution was not part of the isolated test.
