IPAPI.GR for Cloudflare Workers

// wrangler.jsonc
{
  "name": "visitor-lookup",
  "main": "src/index.js",
  "compatibility_date": "2026-11-01",
  // Run in front of your site. The Worker forwards each request to your origin.
  "routes": [{ "pattern": "example.com/*", "zone_name": "example.com" }]
}

# Stored encrypted by Cloudflare, read as env.IPAPI_KEY
npx wrangler secret put IPAPI_KEY
npx wrangler deploy

// src/index.js: Cloudflare Worker in front of your origin.
// Store the key as a secret: npx wrangler secret put IPAPI_KEY
const LOOKUP = 'https://ipapi.gr/api/lookup/';
const AI_CLAIM = /GPTBot|OAI-SearchBot|ChatGPT-User|ClaudeBot|Claude-SearchBot|Claude-User|PerplexityBot|Perplexity-User/i;

// Per-isolate memory: short-lived, but it saves repeat lookups for busy visitors.
const memo = new Map();
const TTL_MS = 10 * 60 * 1000;

const known = (v) => (v === undefined || v === null || v === '' || v === 'No Data' ? null : v);

async function lookup(ip, env) {
  const hit = memo.get(ip);
  if (hit && hit.expires > Date.now()) return hit.data;
  try {
    const res = await fetch(LOOKUP + encodeURIComponent(ip) + '?key=' + encodeURIComponent(env.IPAPI_KEY), {
      signal: AbortSignal.timeout(1500)
    });
    if (!res.ok) return null;
    const data = await res.json();
    if (memo.size > 5000) memo.clear();
    memo.set(ip, { data, expires: Date.now() + TTL_MS });
    return data;
  } catch {
    return null; // timeout or network error: fail open
  }
}

export default {
  async fetch(request, env) {
    const ip = request.headers.get('CF-Connecting-IP'); // set by Cloudflare, cannot be spoofed by the client
    const data = ip ? await lookup(ip, env) : null;

    // Paid plans return risk flags: refuse self-declared AI crawlers whose address is not a known AI crawler.
    const ua = request.headers.get('User-Agent') || '';
    if (data && data.risk && AI_CLAIM.test(ua) && !data.risk.is_ai) {
      return new Response('Unverified crawler', { status: 403 });
    }

    // Pass the answer to your origin as request headers.
    const upstream = new Request(request);
    upstream.headers.set('X-Visitor-Country', known(data && data.country_code) || '');
    upstream.headers.set('X-Visitor-ASN', known(data && data.asn) || '');
    upstream.headers.set('X-Verified-AI', data && data.risk ? String(data.risk.is_ai) : '');
    return fetch(upstream);
  }
};