To block VPN users on your website, check each visitor's IP with a VPN detection API and decide per action: block or challenge high-confidence VPNs at signup, login and checkout, and let readers through. The check runs in your backend with one API call, or with no code in front of the site through a Cloudflare Worker, a WordPress plugin, or a Traefik, Caddy or nginx gate. Blocking every VPN outright is rarely right, because many VPN users are legitimate customers.
Decide what you actually want
Before implementing anything, separate the goal from the method:
- Compliance / licensing: you may genuinely need to block access from anonymised IPs in certain regions.
- Fraud reduction: you don't need to block; you need to add friction where risk is high.
- Abuse prevention: you want to stop multi-accounting and trial abuse, which is about signups, not browsing.
Most sites are in the second or third bucket, where challenge beats block.
Check whether an IP is using a VPN
Step 1: detect VPN traffic reliably
You can't act on what you can't see. Use a detection service that returns a verdict and a confidence score rather than a yes/no list; see how VPN detection works for why the score matters. The VPN detection API returns both for any IP.
Step 2: choose block vs. challenge by action
Map the confidence score to a response that fits the action's risk:
| Action | Low score | Mid score | High score |
|---|---|---|---|
| Read content | allow | allow | allow |
| Sign up | allow | email/phone verify | verify + review |
| Log in | allow | step-up auth | step-up auth |
| Checkout / withdraw | allow | verify | block or manual review |
This way a privacy-minded reader is never inconvenienced, while a high-confidence VPN at checkout gets appropriate scrutiny.
Step 3: implement server-side
Run the check on your backend, not in the browser, so it can't be bypassed and your API key stays secret. The flow:
- User triggers a sensitive action.
- Your server calls the detection API with the client IP.
- You read the verdict + score and apply the table above.
For a concrete implementation, see how to detect VPN in Node.js.
No backend changes? Run the same check in front of the site with the Cloudflare Worker, the WordPress plugin or the Traefik, Caddy and nginx integrations. Each starts in monitor mode, so you see what would be blocked before anything is; blocking needs a paid plan.
Step 4: prefer scoring over hard rules
If you find yourself writing lots of if-statements, consolidate. Feed the VPN signal into an IP fraud score alongside proxy, Tor and reputation, and gate on the single number. It is easier to tune and harder to game.
Avoiding false positives
- Use the score, not a binary flag. Reserve hard blocks for high confidence.
- Allowlist known corporate/cloud egress that your real users legitimately come from.
- Give users a path. If you must block, show a clear message and a way to verify rather than a dead end.
Bottom line
Don't block every VPN user: detect VPN traffic with a confidence score, then block or challenge based on the action's risk. Run the check server-side, prefer challenges over hard blocks, and consolidate the logic into a single fraud score so it stays easy to tune.
FAQ