Works with your stack
Rules by country with your host or CDN
same page for everyone
Rules by country need the visitor’s country. Cookie Rocks Pro can read it from your CDN, from your host’s server, or from a country database on your own server. The page stays the same for everyone: the country is asked for separately, from an address that is never cached.
So where is your site, really?
not everywhere, we promise
Hosting and CDN, one by one
The legal side
Your questions about hosting
Where is my site hosted if I use a CDN?
Your site is hosted where its files and database live: that place is called the origin.
A CDN keeps copies of your public pages on servers around the world and delivers them from the one closest to each visitor. The CDN also passes on every request, so it sees your visitors' IP addresses and the pages they ask for, and forms and logins usually go through it on their way to your origin.
What should I answer when a client or a form asks where my site is hosted?
Give the country of your origin, then name your CDN.
For example: "Our site is hosted in [country] by [host]. We also use [CDN], which delivers copies of our pages from servers in several countries." If you do not know the country, your host can tell you. It is usually in your hosting account too.
Is using a CDN a data transfer abroad?
Often, yes.
A visitor's IP address can identify a person, and it reaches the CDN's servers, which may be outside your country. Treat it as a transfer unless your CDN lets you limit its servers to your own region, and check that your contract with it covers transfers. In the EU, the UK and many other countries this is usually done with standard contract clauses or a recognised framework, and large CDNs include them in their terms.
It depends on the countryCalifornia has no rule on sending data abroad, Vietnam counts a platform abroad as a transfer and asks for an assessment, Brazil has its own standard clauses, and China and Russia have stricter rules. See each country page.
Does my host or CDN count as a processor? Do I need a contract with them?
Usually, yes.
In the EU, a host that only stores data for you is still a processor, and you need a contract with it. Large hosts and CDNs already have one, often called a data processing agreement: look for it in your account or their legal pages, and keep a copy.
It depends on the countrysome countries ask for a written contract, others only for protection by a contract or other means, and a few set no rule. See the country pages and the processor agreement.
Must my data stay in my country?
Usually not.
Most countries let you host abroad under their transfer rules. A few require local storage, and some sectors, such as health or public bodies, can have their own rules. See data localisation.
What do I write in my privacy policy about hosting?
Say who hosts your site and who delivers it, by name or by type.
Say in which country the site is hosted, whether data goes abroad and on what basis, what the logs contain and how long they are kept. The free Audit checks these points on your page.
It depends on the countrysome countries ask for more. In Brazil, for example, standard clauses come with a public page in Portuguese about the transfer.
Does a US company with EU servers change anything?
It helps, but it does not settle everything.
Data stored in the EU stays under EU rules, but US staff who can reach it from the US count as a transfer, even if they only view it on a screen. So check two things: where support and administration happen, and what covers that access, such as the provider's listing under the EU-US Data Privacy Framework or standard contract clauses. Your provider's terms should say both.
When the provider is an EU company with a US parent, and nobody outside the EU can reach the data, using it is not a transfer. A foreign authority may still ask that company for data, so check what its contract says about such requests.
It depends on the countrythe same question exists in other countries, with their own rules. In Switzerland and the UK, for example, a US provider needs their own version of the framework, or their own standard clauses.
Sources: EDPB, Guidelines 05/2021 on Article 3 and Chapter V of the GDPR · EDPB, Guidelines 07/2020 on controller and processor. The rules of each country are on its page. See your country · The subtleties, in plain words
What matters for consent with Hosting and CDN
The page is never split by country
The cached page is the same for every visitor. The banner asks for the visitor’s profile from geo.php or the REST route cookie-rocks/v1/geo, which answer with Cache-Control: private, no-store.
A CDN header is checked before it is trusted
Cloudflare, Bunny and Pantheon send the country in a request header. Cookie Rocks uses it only after Verify now: the site sends itself a fake country, ZZ, and trusts the header only if the CDN replaces it. The check runs again every day.
Cloudflare also has to be the sender
With Cloudflare, each request must also carry Cloudflare’s CF-Ray mark and come from Cloudflare’s address ranges. A CF-IPCountry header sent straight to your server is ignored.
A server variable is set by the server
LiteSpeed, Kinsta and WordPress VIP give PHP the country in a server variable, not in a request header, so a visitor cannot write it.
Without a CDN or host source
Cookie Rocks can read the country from a database kept on your own server, updated from a signed file. With no trusted source at all, every visitor gets the strict rules.
What our tests found on Hosting and CDN
Good to know · Cookie RocksPantheon and WordPress VIP give rules by US state
With the Pantheon source, rules by country read the region in the Pantheon-Geo header (region=TX, or region_code in the older format); with the WordPress VIP source they read GEOIP_REGION, written TX or US-TX. A visitor from Texas then gets the rules of Texas; without a region, a visitor from the United States gets the rules of California.
Seen in our tests, 26 October 2026, Cookie Rocks.
Good to know · Bunny CDNA visitor cannot forge Bunny's country header through the CDN
A CDN-RequestCountryCode or CDN-RequestStateCode header sent by the visitor, in any letter case, over IPv4 or IPv6, is replaced by Bunny's own value before the request reaches the origin. A request that goes straight to the origin, without passing through Bunny, is not protected.
Seen in our tests, 25 October 2026, Bunny CDN.
Good to know · Bunny CDNBunny sends the visitor's country and region to the origin
On a pull zone with default settings, Bunny adds CDN-RequestCountryCode (two letters) and CDN-RequestStateCode (the subdivision code without the country prefix: two letters such as CA for a visitor in California, seen from a US server on 25/10/2026) to every request sent to the origin, along with CDN-ServerZone. CDN-RequestStateCode is not in Bunny's documentation.
Seen in our tests, 25 October 2026, Bunny CDN. Source
Good to know · Cookie RocksWith Bunny CDN, rules by country know the US state
With the Bunny CDN source verified, rules by country read the visitor's state from CDN-RequestStateCode, so a visitor from the United States gets the rules of their own state.
Seen in our tests, 25 October 2026, Cookie Rocks.
Good to know · OpenLiteSpeedOpenLiteSpeed GeoIP gives no region code with DB-IP Lite
With enableIpGeo and a geoipdb block (geoipDBName CITY_DB), OpenLiteSpeed gives PHP GEOIP_COUNTRY_CODE as two capital letters (IPv4 and IPv6), plus GEOIP_COUNTRY_NAME, GEOIP_REGION_NAME and GEOIP_CITY. With the free DB-IP City Lite database, GEOIP_REGION is missing, because that database has no subdivision code. Private or unknown addresses get no variables. A visitor's GEOIP-Country-Code request header becomes HTTP_GEOIP_COUNTRY_CODE and never overwrites GEOIP_COUNTRY_CODE. An ipToGeo block in the config file is ignored without any message.
Seen in our tests, 25 October 2026, OpenLiteSpeed 1.9.3. Source
Good to know · OpenLiteSpeedOpenLiteSpeed gives the region code with GeoLite2-City
With the GeoLite2-City database (geoipDBName CITY_DB), OpenLiteSpeed gives PHP GEOIP_REGION as the subdivision code without the country, such as CA or TX in the United States (three letters in some countries). An address without a subdivision in the database gives the country only. A visitor's GEOIP-Region request header becomes HTTP_GEOIP_REGION and does not change GEOIP_REGION.
Seen in our tests, 25 October 2026, OpenLiteSpeed 1.9.3. Source
See the 12 other findings
Good to know · Cookie RocksWP Engine country is checked like a CDN header
With the WP Engine source, rules by country use HTTP_GEOIP_COUNTRY_CODE only after the spoof check (Verify now, repeated every day): the site sends itself GEOIP-Country-Code: ZZ, and the source is trusted only if another value comes back.
Seen in our tests, 25 October 2026, Cookie Rocks.
Good to know · WP Engine GeoTargetWP Engine's country variable is read outside the page cache
NitroPack reads getenv('HTTP_GEOIP_COUNTRY_CODE') at the very start of each PHP request on WP Engine, GeoTargetingWP reads it in its admin-ajax mode, and the WP Engine GeoTarget plugin checks it in wp-admin: the value reaches PHP requests that bypass the page cache.
Read in its code, 25 October 2026, WP Engine GeoTarget.
Good to know · WP Engine GeoTargetWP Engine GeoTarget is paid, and its variable has a header name
GeoTarget comes with Premium plans and is bought separately on Lite, Startup, Growth and Scale; WP Engine support then turns on a cache bucket (continent, country, state or region, city) for each environment. PHP reads getenv('HTTP_GEOIP_COUNTRY_CODE') and getenv('HTTP_GEOIP_REGION') (two letters in the US and Canada, a number elsewhere). Only the platform sets these values: the WP Engine GeoTarget plugin reads them and does not create them. Edge Full Page Cache must be off. Because the name has the HTTP_ prefix, on Apache with mod_php a visitor's GeoIP-Country-Code request header also shows up in getenv('HTTP_GEOIP_COUNTRY_CODE') (tested on 25/10/2026 in a php8.3-apache container).
Read in its code, 25 October 2026, WP Engine GeoTarget 1.2.9. Source
Good to know · WordPress VIPWordPress VIP sets geolocation variables without Geo Uniques
WordPress VIP fills $_SERVER['GEOIP_COUNTRY_CODE'] (ISO 3166-1), GEOIP_REGION (ISO 3166-2 first-level subdivision), GEOIP_CONTINENT, GEOIP_CITY, GEOIP_POSTAL_CODE and GEOIP_METRO_CODE for every WordPress site. The VIP Go Geo Uniques plugin only reads GEOIP_COUNTRY_CODE and sends Vary: X-Country-Code. Behind a reverse proxy such as Cloudflare, VIP sees the proxy's address, so the country is usually wrong.
Read in its code, 25 October 2026, WordPress VIP. Source
Good to know · CloudwaysCloudways GeoIP sends the country name, not a code
With GeoIP turned on for an application (Application Settings, Enable GeoIP; all plans), Cloudways' Nginx adds X-Forwarded-Country with the full country name in its current English form (for example Spain, or South Korea rather than the older Korea, Republic of) and X-Forwarded-Continent with a two-letter code. No region is sent. PHP-FPM receives them as HTTP_X_FORWARDED_COUNTRY and HTTP_X_FORWARDED_CONTINENT, also through getenv(). Turning GeoIP on makes Varnish keep a separate cached copy per location.
Seen in our tests, 25 October 2026, Cloudways. Source
Good to know · CloudwaysA visitor cannot forge Cloudways' country header
With Geo IP Detection on, Cloudways' Nginx replaces any X-Forwarded-Country, X-Forwarded-Continent, X-Forwarded-For or X-Real-IP header sent by the visitor, in any letter case, including for a request sent straight to the server's IP address. PHP always sees the values Nginx computed from the visitor's address.
Seen in our tests, 25 October 2026, Cloudways.
Good to know · Cookie RocksRules by country read Cloudways' country name
With the Cloudways source, rules by country convert the English country name sent in X-Forwarded-Country (such as South Korea or The Netherlands, from the GeoLite2, DB-IP or older GeoIP databases) to its two-letter code. A name it does not know gives the strict rules.
Seen in our tests, 25 October 2026, Cookie Rocks.
Good to know · CloudflareCloudflare and the country database can disagree on one address
Cloudflare and the DB-IP country database can give different countries for the same address. A mismatch can only make the rules stricter for a US visitor seen in Europe.
Seen in our tests, 23 October 2026, Cloudflare DB-IP lite country, edition 2026-10-20.
Full detail
For the same visitor address, Cloudflare's CF-IPCountry said IT while the DB-IP lite country database (edition 2026-10-20) said NO. Both gave the strict profile here, but two sources can disagree on the country of one address: a US visitor seen in Europe by one source would get the strict rules rather than the US profile.
Depends on a setting · CloudflareCloudflare Free can send the visitor's US state to the site
Turn on 'Add visitor location headers' in Cloudflare so that rules by country can read a US visitor's state (CF-Region-Code). It is off by default.
What to do: Enable 'Add visitor location headers' so that country rules can read the US state (CF-Region-Code).
Seen in our tests, 23 October 2026, Cloudflare. Source
Full detail
On a Cloudflare Free zone, the Managed Transform 'Add visitor location headers' (Rules, Settings, Managed Transforms) is available, off by default. Turned on, it adds cf-ipcountry, cf-region-code, cf-ipcity and coordinates to requests sent to the site. Without it, only CF-IPCountry is sent (IP Geolocation setting), so a US visitor's state is unknown.
Good to know · Cookie RocksThe country database works end to end on a real site
On a real site behind Cloudflare, the country database downloaded, verified and answered correctly, never cached, and forged Cloudflare headers got the strict rules.
Seen in our tests, 23 October 2026, Cookie Rocks country database edition 2026-10-20.
Full detail
On a real site behind Cloudflare, the 'country database on this server' source of Cookie Rocks 2.7.0 worked end to end: signed manifest and signature read, 8,300,093-byte file downloaded in 0.5 s, checksum verified, source trusted. Test addresses got the right country and a private address got the strict rules. geo.php and the REST route answered with Cache-Control private, no-store and were never cached by Cloudflare (cf-cache-status DYNAMIC). A direct request to the site with forged Cloudflare headers got the strict rules.
Depends on a setting · Cookie RocksBehind Cloudflare on some hosts, choose the country database
If your host rewrites the visitor's address behind Cloudflare (mod_cloudflare, mod_remoteip), choose 'country database on this server' as the source in Rules by country.
What to do: In Rules by country, choose 'country database on this server' as the source, then Update now.
Seen in our tests, 23 October 2026, Cookie Rocks.
Full detail
Some hosts rewrite REMOTE_ADDR with the visitor's address behind Cloudflare (mod_cloudflare or mod_remoteip). There, Cookie Rocks 2.7.0 with the Cloudflare source gives every visitor the strict rules, because the request no longer seems to come from Cloudflare. The 'country database on this server' source reads that visitor address and gives the right profile.
Good to know · CloudflareThe Cloudflare plugin adds nothing to visitor pages
It adds no script, style or cookie and does not use WP Consent API. It clears the APO cache on content changes, not when another plugin saves its settings.
Read in its code, 16 October 2026, Cloudflare 4.14.5.
Full detail
The Cloudflare plugin adds no script, style or cookie to visitor pages and does not use WP Consent API; it only sends a cf-edge-cache header telling APO whether the page may be cached. It purges APO on content publication or change, comments, theme switch and Customizer save, not when another plugin saves its settings. Its purge filters (cloudflare_purge_everything_actions, cloudflare_purge_url_actions) are read when the plugin loads; a public method, Hooks::purgeCacheEverything(), purges the whole zone.
Hosting and CDN
Other plugins of the same kind.
Questions
What does a visitor get when the country is unknown?
The strict rules: nothing loads before the choice, and the banner shows Reject all next to Accept all.
Is the visitor’s address kept?
No. With the country database, the address is only used for the lookup and never stored.
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For sites with visitors from several countries
The right rules for each visitor’s country.
country by country
Rules by country are part of the complete plugin. Every feature of the complete plugin for 30 days, no card.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.