Check ID: zone_ip_geolocation_enabled
Provider: Cloudflare
Service: zone
Severity: LOW
Categories: internet-exposed
Resource type: Zone

​
What this check verifies

Cloudflare zones are assessed for IP Geolocation configuration by checking if it is enabled to add the CF-IPCountry header to requests, enabling geographic-based access controls, firewall rules, and analytics.

​
Risk

Without IP Geolocation, geographic-based security controls cannot be implemented.
  • Confidentiality: unable to restrict access from high-risk regions
  • Integrity: cannot enforce geographic data residency requirements
  • Availability: limited visibility into traffic origins for threat analysis

​
Recommendation

Enable IP Geolocation to support geographic-based security policies.
  • Adds CF-IPCountry header to all requests
  • Enables geo-blocking rules in firewall configuration
  • Provides visibility into traffic origins for threat analysis
  • Essential for geographic data residency compliance

​
Remediation

# Enable IP Geolocation for geographic-based security controls
resource "cloudflare_zone_settings_override" "ip_geolocation" {
  zone_id = "<ZONE_ID>"
  settings {
    ip_geolocation = "on" # Adds CF-IPCountry header for geo-based controls
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = zone_ip_geolocation_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Cloudflare checks