Works with your stack
Cookie consent behind Bunny CDN
country in every request
Bunny CDN adds the visitor’s country to every request it sends to your site, with no setting to turn on. Cookie Rocks Pro can use it for rules by country once Verify now has shown that Bunny replaces the header.
By BunnyWay d.o.o. · bunny.net
Is this your product? Tell us if anything here is out of date. Write to us
What matters for consent with Bunny CDN
Country and region in every request
A pull zone with default settings adds CDN-RequestCountryCode and CDN-RequestStateCode to each request sent to your site.
A header the visitor cannot forge through Bunny
A country header sent by the visitor is replaced by Bunny’s own value, in any letter case, over IPv4 or IPv6. A request that skips Bunny and goes straight to your server is not protected, which is why Cookie Rocks checks the source first.
What our tests found on Bunny CDN
Good to know · Bunny CDNA visitor cannot forge Bunny's country header through the CDN
A CDN-RequestCountryCode or CDN-RequestStateCode header sent by the visitor, in any letter case, over IPv4 or IPv6, is replaced by Bunny's own value before the request reaches the origin. A request that goes straight to the origin, without passing through Bunny, is not protected.
Seen in our tests, 25 October 2026, Bunny CDN.
Good to know · Bunny CDNBunny sends the visitor's country and region to the origin
On a pull zone with default settings, Bunny adds CDN-RequestCountryCode (two letters) and CDN-RequestStateCode (the subdivision code without the country prefix: two letters such as CA for a visitor in California, seen from a US server on 25/10/2026) to every request sent to the origin, along with CDN-ServerZone. CDN-RequestStateCode is not in Bunny's documentation.
Seen in our tests, 25 October 2026, Bunny CDN. Source
Good to know · Cookie RocksWith Bunny CDN, rules by country know the US state
With the Bunny CDN source verified, rules by country read the visitor's state from CDN-RequestStateCode, so a visitor from the United States gets the rules of their own state.
Seen in our tests, 25 October 2026, Cookie Rocks.
Hosting and CDN
Other plugins of the same kind.
Questions
Does Bunny’s cache split pages by country?
Cookie Rocks does not need it to. The page is the same for everyone and the country is asked for from an address that is never cached.
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For sites behind Bunny
Bunny at the edge, the right rules for each country.
bunny stays on
Rules by country are part of the complete plugin. Every feature of the complete plugin for 30 days, no card.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.