Back to Checks
cloudflare

IP Geolocation is enabled

zone_ip_geolocation_enabled
Service: zoneSeverity: low
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:Zone

Cloudflare zones are assessed for IP Geolocation configuration by checking if it is enabled to add the CF-IPCountry header to requests, enabling geographic-based access controls, firewall rules, and analytics.

Prowler logoProwlerprowler-provider-cloudflare

Risk

Without IP Geolocation, geographic-based security controls cannot be implemented.

  • Confidentiality: unable to restrict access from high-risk regions
  • Integrity: cannot enforce geographic data residency requirements
  • Availability: limited visibility into traffic origins for threat analysis

Run this check with Prowler

Run in Prowler Cloud
Run
prowler cloudflare --checks zone_ip_geolocation_enabled

Recommendation

Enable IP Geolocation to support geographic-based security policies.

  • Adds CF-IPCountry header to all requests
  • Enables geo-blocking rules in firewall configuration
  • Provides visibility into traffic origins for threat analysis
  • Essential for geographic data residency compliance

Remediation

Terraform

# Enable IP Geolocation for geographic-based security controls
resource "cloudflare_zone_settings_override" "ip_geolocation" {
  zone_id = "<ZONE_ID>"
  settings {
    ip_geolocation = "on" # Adds CF-IPCountry header for geo-based controls
  }
}

Other

1Log in to the Cloudflare dashboard and select your account and domain
2Go to Network
3Scroll to IP Geolocation
4Toggle the setting to On
5Use the CF-IPCountry header in your firewall rules or application logic

Check Code

from prowler.lib.check.models import Check, CheckReportCloudflare
from prowler.providers.cloudflare.services.zone.zone_client import zone_client


class zone_ip_geolocation_enabled(Check):
    """Ensure that IP Geolocation is enabled for Cloudflare zones.

    IP Geolocation adds the CF-IPCountry header to all requests, containing the
    two-letter country code of the visitor's location. This enables geographic-based
    access controls, firewall rules, content customization, and analytics based on
    visitor location.
    """

    def execute(self) -> list[CheckReportCloudflare]:
        """Execute the IP Geolocation enabled check.

        Iterates through all Cloudflare zones and verifies that IP Geolocation
        is enabled. This feature adds geographic information to requests for
        enhanced security controls and analytics.

        Returns:
            A list of CheckReportCloudflare objects with PASS status if IP
            Geolocation is enabled, or FAIL status if it is disabled for the zone.
        """
        findings = []
        for zone in zone_client.zones.values():
            report = CheckReportCloudflare(
                metadata=self.metadata(),
                resource=zone,
            )
            ip_geolocation = (zone.settings.ip_geolocation or "").lower()

            if ip_geolocation == "on":
                report.status = "PASS"
                report.status_extended = (
                    f"IP Geolocation is enabled for zone {zone.name}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"IP Geolocation is not enabled for zone {zone.name}."
                )
            findings.append(report)
        return findings

References