Use bounded network reputation without confusing it with proof

Where: Protection → Challenges and network

Steps

1. Obtain the supported ipapi.is credential and review its privacy implications.
2. Select VPN/proxy/Tor signals and a UTC daily lookup budget.
3. Keep record-only policy first; review how legitimate visitors are classified.
4. Choose challenge or denial only after assessing false positives and service availability.
5. Review provider/cache diagnostics and recorded network signals.

Check the result

Visitor addresses go to the configured provider. Error/unknown results do not establish abuse; base protection remains independent.

If it does not work

Optional calls are bounded, cached and require the supported runtime. A provider key or flag is not a guarantee of accurate VPN detection. Never paste secrets into public support logs.