How to detect VPN and proxy visitors on your website
A step by step way to check for VPN, Tor and data center connections at key moments such as sign-up, login and payment, and decide how to respond.
Why look at the IP
The same person claiming a free trial again and again, bots repeating sign-ups, and payments that pretend to come from another country mostly arrive through VPNs, proxies and cloud servers. Looking at which network a visitor IP comes from lets you catch a good share of these connections.
1. Get the visitor's real IP
The IP of the connection your server receives is the visitor IP. If your site sits behind a proxy such as Cloudflare, that connection IP belongs to Cloudflare, so use the CF-Connecting-IP header; behind another load balancer, use the first value of the X-Forwarded-For header it adds. Visitors can forge these headers, so trust them only on requests that came through your own proxy.
2. Look up only at key moments
You do not need a lookup on every page. Checking the IP only at moments where abuse costs you money, such as sign-up, login, password reset, payment and coupon use, keeps things fast and cheap. Cache the result for the same IP for a few minutes and reuse it.
3. Decide how to respond
For a Tor exit, a known VPN server or a data center IP, adding an extra check such as email or SMS verification works better than blocking outright, because some genuine customers use a VPN for privacy. For payments, also check whether the card's issuing country differs from the connection country.
4. Keep a record
Saving the check result with your sign-up and payment records makes it easier to find the same pattern of abuse later. An IP address is personal data, though, so state the purpose and how long you keep it in your privacy policy.
Know the limits
VPNs that are not on public lists and proxies that rent home internet connections are hard to find from the IP alone. Browser signals help: whether the browser time zone differs from the IP's country, and whether WebRTC shows a different IP.
Check your IP and location now.
Check my IP