Geotargeting looks like the simplest rule in traffic filtering: allow these countries, block the rest. In practice it is where a lot of legitimate revenue quietly disappears, because IP geolocation is an estimate and people are more mobile than your rules assume.
What accuracy you can actually expect
Geolocation accuracy degrades sharply as you narrow the target. Planning with realistic numbers prevents a lot of disappointment:
| Level | Typical reliability | Reasonable use |
|---|---|---|
| Country | Very high | Licensing, compliance, currency, language |
| Region / state | Good, varies by market | Regional offers, tax and shipping logic |
| City | Moderate | Store locators, soft personalisation |
| Postal code | Low | Rarely safe as a hard rule |
Country-level targeting is dependable enough to build business rules on. City-level should influence presentation, not gate access. Anything finer should be treated as a hint you invite the user to correct.
The failure modes that cost you money
Several populations are routinely misplaced by geolocation, and they are disproportionately valuable ones:
- Mobile users. Carrier infrastructure can route traffic through gateways far from the physical device. A subscriber may consistently appear in a different city, or a different country, than where they are standing.
- Corporate VPN users. Employees egress through headquarters. A remote worker in one country appears in another every working day.
- Satellite and rural connections. Frequently attributed to a provider hub rather than the subscriber.
- Recently reallocated ranges. Address blocks are transferred between organisations and regions; databases lag by weeks or months.
- Travellers. Genuinely in a different country, still your customer, often with the highest intent of anyone on your site.
Where geography is a preference rather than a legal requirement, prefer routing over refusing. Send an out-of-target visitor to a page that fits them—a different market, a general offer, a language chooser—instead of a blank refusal. You keep the option of a conversion you would otherwise have thrown away.
Corroborating location with other signals
Because the IP alone can be wrong, useful systems corroborate it. Three cheap secondary signals:
- Browser timezone. Reported from the operating system and independent of the network path. Agreement with the IP raises confidence considerably, and disagreement feeds the risk score.
- Accept-language. Weak alone, useful in aggregate, and directly actionable for choosing which language to serve.
- Stated preference. If a visitor has previously selected a country or currency, that beats every inference you can make.
When the IP and the timezone agree, act confidently. When they disagree, that is precisely the moment to offer a choice rather than impose one.
Device and browser detection
Device detection carries the same trap: the client tells you what it is, and clients lie. The distinction that matters is between declared and observed attributes.
Declared attributes come from the user agent string and client hints. They are convenient, and trivially spoofed. Observed attributes—viewport dimensions, pointer capability, touch support, device pixel ratio, rendering behaviour—are harder to fake consistently.
Use declared attributes to decide what to serve. Use the agreement between declared and observed attributes to decide how much to trust the visitor. A client claiming to be a current iPhone while reporting a desktop pointer, a mismatched pixel ratio, and a software rasteriser is not an iPhone, and that inconsistency belongs in your risk score rather than your layout logic.
Routing patterns worth having
A small set of patterns covers most real requirements:
- Market routing. Country determines the storefront: currency, language, shipping, and legal copy.
- Compliance gating. Regulatory restrictions genuinely require refusal in some jurisdictions. This is the one case where a hard block is the correct answer.
- Device-appropriate offers. App install campaigns routed by platform, with a web fallback for everything else.
- Graceful fallback. Every rule needs a defined destination for “none of the above”. Undefined fallbacks are how visitors reach blank pages.
Testing rules before they cost you
Geo and device rules are easy to get wrong in ways that are invisible from your own desk, because you always test from one location on one device.
- Run the rule in log-only mode first and check the share of traffic each branch would receive. A branch capturing far more or far less than expected is a broken rule.
- Verify from multiple real locations and networks, including at least one mobile connection.
- Confirm the fallback path renders a real page.
- Alert on branch distribution. If a market silently drops to zero, you want to know that day, not at month end.
Takeaways
- Country-level geolocation is reliable; city-level should personalise, not gate.
- Mobile, corporate VPN, and satellite users are routinely misplaced—and are often your best customers.
- Corroborate the IP with browser timezone before acting on location.
- Serve on declared device attributes; score on the gap between declared and observed.
- Route rather than refuse unless a regulation genuinely requires refusal, and always define the fallback.
See it on your own traffic
MaxGuard scores every visit against IP intelligence, device and behavioural signals, then blocks, routes, or allows it by your rules.
Request access