=== WPLocation - Geolocation and Country Rules ===
Contributors: wplocation
Tags: geolocation, geotargeting, conditional content, country, visibility
Requires at least: 6.8
Requires PHP: 7.4
Tested up to: 7.1
Stable tag: 1.1.11
License: GPLv3 or later
License URI: https://www.gnu.org/licenses/gpl-3.0.html

WordPress geolocation and geotargeting: show posts, pages and blocks by visitor country using local GeoLite2 Country data.

== Description ==

WPLocation is a free WordPress geolocation and geotargeting plugin for country-based content. Show the right post, page or content section to a visitor's detected country using a local GeoLite2 Country database.

= What you can do with Free =

* Set include or exclude country audiences for WordPress posts, pages and categories.
* Show selected sections with the Country visibility block in the WordPress block editor.
* Use [wplocation_target] for country-based conditional content and [wplocation_country] to display the detected country.
* Search country choices, review a saved audience and test a country decision before checking the real page.
* Check your local source and database build date in Diagnostics.
* Use your own current licensed country database without a paid WPLocation key or visitor lookup credits.

= Practical examples =

Show a regional announcement on a shared page, display a country-specific message, or limit a published page to selected countries. Keep useful general content outside targeted sections. IP location is approximate: country visibility is personalization, not a firewall or access control for confidential content.

= Set up your first country rule =

Install Free, connect a current licensed GeoLite2 Country database in Settings, check Diagnostics and create a page audience or Country visibility block. Test allowed, denied and unknown locations and your actual page cache. Follow the illustrated setup guide: https://wplocation.com/documentation/installation/.

= Free, Pro and add-ons =

Free works independently and is distributed and updated through WordPress.org. Pro and specialist add-ons are separate plugins sold by WPLocation.com; keep Free active with Pro. Pro adds WooCommerce rules, Geo Redirects, Markets, Forms & Campaigns and opt-in Geo Analytics. Pro 1.4.5 or newer requires PHP 8.3. No paid feature implementation is locked inside Free.

= SEO and cache behavior =

Country visibility does not create translations, regional URLs or hreflang tags and does not guarantee search rankings. A crawler outside a whole-page audience can receive a 404, and a targeted section may be absent from its view. Use discoverable regional URLs when needed and treat crawlers like visitors from the same country. Setup and limitations: https://wplocation.com/documentation/geolocation-speed-seo/.

= Country data, privacy and safe upgrades =

Local country lookup needs a current, licensed GeoLite2 Country MMDB. Separately installed, trusted country-source adapters may provide a verified country through the extension hook; their infrastructure and privacy requirements are documented by that adapter. No visitor-country service or paid account is required by Free itself. It does not bundle location data. You can select a private server file or use your own MaxMind account ID and license key to download one from Settings. Automatic updates are opt in and off by default. When enabled, the updater contacts MaxMind for an authorized download and follows its signed Cloudflare R2 file URL. The providers receive your site's server IP and MaxMind receives the account credentials. Visitor IPs remain on your server during local lookups and are not sent by the updater. See https://dev.maxmind.com/geoip/geolite2-free-geolocation-data/, https://www.maxmind.com/en/geolite/eula, https://www.maxmind.com/en/privacy-policy and https://www.cloudflare.com/privacypolicy/.

Saved MaxMind credentials are non-autoloaded WordPress options, not encrypted at rest; they may appear in database backups. For stronger secret management, define WPLOCATION_MAXMIND_ACCOUNT_ID and WPLOCATION_MAXMIND_LICENSE_KEY in wp-config.php. Those constants take priority. The plugin does not display saved keys or record them in its activity log.

Store the MMDB outside the public web root. Automatic updates save validated copies beside the configured source, select them atomically and retain the last working file on failure. Recorded unchanged retired copies can be removed after two days; configured and untracked files remain the site's responsibility. WordPress cron needs traffic or a server cron. Follow MaxMind's database update and deletion requirements. This product can use GeoLite Data created by MaxMind, available from https://www.maxmind.com/.

Geolocation is approximate and these rules are for personalization, not access control for confidential content. When a country cannot be determined, restricted content is hidden. Caches and CDNs can serve the wrong country or bypass WordPress altogether. While Free is active, the plugin requests no-store responses for frontend HTML and country-aware post, page and search REST reads because targeted content can appear in posts, blocks and secondary queries. It purges WP Super Cache when its API is present, but you must configure and test any shared cache. Forwarded IP headers are not trusted by default; verified infrastructure can provide an address with the wplocation_verified_client_ip filter.

Upgrading an older standalone build requires a current country source. A database stored inside the old plugin folder is removed by WordPress's replacement flow; this release does not bundle, restore or silently copy obsolete location data. Before updating, back up the site and rules, prepare a current licensed GeoLite2 Country MMDB outside the plugin folder and public web root, and select it with the documented upgrade preparation tool or configuration constant. Existing private database settings and audience storage keys are retained. Without a readable source, country-restricted output stays hidden and the dashboard provides recovery steps. Purge and test every external page or CDN cache after updating.

For older content, standard post and text-widget rendering translates [locationtarget] markup to [wplocation_target] before WordPress processes shortcodes. This does not register the unprefixed legacy shortcode and does not edit saved posts or revisions. Escaped examples are preserved; another plugin that registers the old tag keeps ownership. Use the prefixed shortcode for new content. Page-builder metadata, custom fields and direct do_shortcode() integrations need a separate review and conversion. Private database settings and content are per site on multisite; prepare and verify every site before a network update.

The combined plugin is GPLv3 or later and contains third-party libraries under their own licenses, including Apache-2.0 MaxMind libraries. See THIRD-PARTY-NOTICES.txt and vendor license files.

== Installation ==

1. If upgrading an older standalone build, back up the site and prepare a current licensed database outside the plugin folder before replacing it. Review custom shortcode integrations as described above.
2. Install and activate WPLocation.
3. In WPLocation > Settings, select an existing private GeoLite2 Country MMDB or save your own MaxMind credentials and download one. Alternatively define WPLOCATION_GEOIP_DB_PATH in wp-config.php; this constant takes priority. Illustrated setup: https://wplocation.com/documentation/maxmind-geolite2-country-setup/.
4. In Diagnostics, verify the database date and run a private IP lookup. Create a country rule and test the page with your actual cache and CDN configuration.
5. If you enable automatic updates, monitor WordPress cron and the update status. Purge external page and CDN caches after plugin, data or rule changes.

== Frequently Asked Questions ==

= Does it work without a MaxMind account? =

Yes, if you already have a current, licensed GeoLite2 Country MMDB that you can maintain. The in-plugin GeoLite download requires your own MaxMind account and license key.

= Does it secure confidential content? =

No. IP location is approximate. Other APIs, feeds, queries and caches may expose content. Use WordPress access controls for confidential material.

= Is every page cache or CDN compatible? =

No. A cache can serve an existing response before this plugin runs. Test targeted URLs from different countries and bypass or vary shared cache entries when necessary. WP Super Cache is purged on activation, updates and rule or data changes when its API is available. Other caches need their own purge or configuration.

= Can country rules affect SEO? =

Yes. A whole-page rule returns a 404 outside the selected audience, including for search crawlers in those countries. Core sitemap URL lists remain independent of visitor country, but listing a URL does not make its content available or guarantee indexing. Keep important general content public and use targeted sections for regional messages. The plugin does not automatically create translated URLs, hreflang tags or search ranking improvements.

= Why does my page cache show a bypass? =

WPLocation conservatively requests no shared caching for frontend HTML because rules, blocks, shortcodes and other integrations can personalize a response. Do not remove this protection solely because the main page has no rule. An existing CDN or page-cache response can still run before WordPress: configure and test that layer separately.

== Screenshots ==

1. Select the countries that can see a WordPress page and review the resulting audience.
2. Check whether the private country database is ready and when it was built.
3. Overview: country-source health, saved audiences and setup checklist.
4. Search countries in the Country visibility block editor.
5. Compare Free, Pro and separately installed add-ons.

== Changelog ==

= 1.1.11 =
* Fixed WordPress core sitemap URL lists and pagination varying with the requesting country. Country rules still apply to the real content URLs.
* Bulk-loaded rule objects, metadata and page options to avoid a database query per saved page rule.
* Invalidated request-local rule decisions after rule edits, imports, object changes and category reassignment, with separate caches per site.
* Added search visibility and cache guidance to the audience editor; clarified Free setup, practical uses and optional paid extensions.
* Kept conservative shared-cache protection and all existing data, privacy and upgrade safeguards.


= 1.1.10 =
* Unify Free improvements in the WordPress.org plugin; retire the separate website distribution.
* Redesign Overview with saved audience counts, source health, setup steps and geolocation, cache and SEO guidance.
* Improve the audience editor, add-on controls and Free/Pro comparison without stale embedded pricing.
* Normalize older ISO/name choices in the country picker and explain how to repair malformed saved audiences.
* Replace the old post-editor table with a compact, searchable Country audience panel and explicit Everyone control; invalid saves retain the prior rule.
* Add searchable country choices and an audience summary to the visibility block editor; retain saved block content.
* Translate legacy shortcode markup during standard content rendering without registering an unprefixed shortcode or rewriting saved content.
* Preserve private database and rule settings, and explain recovery when an older bundled database is no longer available.
* Add a validated optional country-source hook and source status for separately installed adapters.
* Restrict changes to network-active add-ons to network administrators; reject malformed audience tokens safely.
* Purge supported page caches on deactivation as well as rule, data and version changes.
* Preserve scoped REST cache headers, PHP 7.4 compatibility and the trimmed vendor package.

= 1.0.0 =
* Preserve safe form fields in conditional content while filtering unsafe HTML.
* Provide a compatibility marker for Pro 1.4.4 or newer without changing the migration-safe directory version number.

* Initial WordPress.org release under the wplocation slug. Version 1.0.0 shared the legacy version number to avoid offering an unattended update to old standalone installations.
* Validate admin inputs as they enter the plugin and document why read-only navigation needs no nonce and why the update lock uses direct SQL.
* Correct the MaxMind credential-removal checkbox layout and publish key-free GeoLite setup and data-source guides on wplocation.com.
* Add post, page and category audience rules, country visibility block, country shortcodes, Diagnostics, Activity Log and mobile admin screens.
* Support a private GeoLite2 Country MMDB and opt-in MaxMind downloads with validated file replacement, rollback and cleanup.
* Clarify migration, data licensing, privacy and cache limitations. The DB-IP source is excluded from this directory edition while its attribution requirements are reviewed.

== Upgrade Notice ==

= 1.1.10 =
Back up first. Legacy standalone builds need a current licensed country database outside the plugin folder before updating. Private settings and rules are retained. Standard legacy shortcode markup is translated; custom integrations need review. Purge caches and test.
