turnley.dev

PHP and MySQL code for faucet operators

Tools & Calculators

LEG-004

Block countries you are not allowed to serve

GeoIP at the edge or in PHP, applied to earning and signup rather than to content, with a message that says what happened.

Sanctions lists and processor terms both mean there are places you may not pay. The requirement is real; how you implement it decides whether it costs you search traffic.

Block the money, not the pages. Signup and withdrawal are the actions with legal weight. Refusing to serve the site at all removes you from search results in those regions for no additional compliance benefit.

Cloudflare's country header is free and requires no database. Without it, a local MaxMind database avoids an outbound lookup on every request.

PHP 
function visitor_country(): string
{
    // Cloudflare sets this at the edge and it cannot be spoofed past them.
    $cf = strtoupper((string) ($_SERVER['HTTP_CF_IPCOUNTRY'] ?? ''));
    if (preg_match('~^[A-Z]{2}$~', $cf)) {
        return $cf;
    }
    // Fall back to a local database if you have one; unknown otherwise.
    return function_exists('geoip_country_code_by_name')
        ? strtoupper((string) @geoip_country_code_by_name(client_ip()))
        : '';
}

function country_blocked(): bool
{
    $list = array_filter(array_map('trim', explode(',', strtoupper(setting('blocked_countries')))));
    if (!$list) {
        return false;
    }
    $country = visitor_country();
    if ($country === '') {
        // Unknown country: allow reading, decide separately about earning.
        return setting_bool('block_unknown_country', false);
    }
    return in_array($country, $list, true);
}

// Applied where it legally matters, not to the whole site:
function guard_signup(): void
{
    if (country_blocked()) {
        http_response_code(403);
        exit('Sorry — accounts are not available in your country. You are welcome to read anything on the site.');
    }
}

Using it

Keep the list in settings. Sanctions change and a redeploy is the wrong mechanism for that.

Say what happened. A blank page or a generic error produces support mail; a plain sentence does not.

Log blocked attempts with the country. If a large share of your traffic is blocked, that is worth knowing before you buy more of it.

What bites people

GeoIP is approximate and VPNs defeat it. It demonstrates reasonable effort; it is not a guarantee, and no honest implementation claims to be.

Blocking content as well as signup removes those pages from search entirely. Rarely the intent, and hard to undo.

Never block your own monitoring or a crawler by accident. Test with the header set before you turn it on.

Also in Legal and Compliance