Skip to main content

FAQ

Does Extendy GeoShield block logins?​

No. The current MVP is notification-only. It records login events, evaluates alert decisions, and can send security notifications, but it does not deny or block logins.

Does a trusted country mean the user is trusted?​

No. A trusted country is only part of the alert decision model. It does not prove that a WHMCS User, Client Account, visitor, IP address, or login is safe.

Does ip_source_verified mean the visitor is trusted?​

No. ip_source_verified means the configured IP source or header was verified as acceptable to use. It does not mean the visitor, IP address, country, WHMCS User, or login is trusted.

Which email address receives alerts?​

For the current MVP, alert emails are sent to the primary WHMCS Client Profile email for the safely resolved client_id.

The WHMCS User email remains the login actor and is included in email content as user_email.

If no safe Client Account context is available, no email is sent.

Why was a login event recorded without an email?​

A login event can be recorded even when no email is sent.

Common verified reasons include:

  • the alert decision was suppressed;
  • cooldown applied;
  • country detection failed and detection-failure alerts are disabled;
  • no safe Client Account context was available;
  • the primary Client Profile email was missing or invalid;
  • the selected template had copied recipients configured;
  • WHMCS SendEmail failed or was aborted.

See Email Alerts and Login Events Log.

Can missing or ambiguous client context prevent email delivery?​

Yes. In the current MVP, email sending requires a safely resolved Client Account context. Multi-client or ambiguous login context can result in client_id = NULL, and no email is sent for that event.

Does Smart Mode automatically trust new countries?​

No. Smart Mode can detect a new country and send a Smart New Country alert when applicable, but trusting the country is a separate authenticated trust-link action.

Trust links expire after 48 hours.

No. Trust links are one-time-use. After successful use, the token is marked used.

Does the user need to be logged in to trust a country?​

Yes. Opening a trust link while logged out must not trust the country. The trust action requires WHMCS authentication and revalidates the token, WHMCS User, and Client Account context.

Which GeoIP providers are supported?​

The current implementation supports:

  • IPinfo Lite API
  • MaxMind GeoIP2 Country web service

Both are remote API/web-service integrations. Extendy GeoShield does not currently support a local MaxMind MMDB database workflow.

Are IPinfo and MaxMind both required?​

No. Select one supported GeoIP provider and configure the required credentials for that provider.

What happens if GeoIP lookup fails?​

The login event is still recorded.

If Alert When Country Detection Fails is No, the event is logged and no client email is sent only because country detection failed.

If it is Yes, the normal login alert template is used with Unknown country values. Smart trust links are not generated for Unknown country alerts.

Which client IP source mode should I choose?​

Use the mode that matches your topology:

  • REMOTE_ADDR for direct access or when no proxy header should be trusted.
  • CF-Connecting-IP only when WHMCS is actually behind Cloudflare.
  • X-Forwarded-For only when WHMCS is behind explicitly configured trusted proxies.

See Client IP Source Modes.

Why is X-Forwarded-For ignored?​

X-Forwarded-For is ignored unless the immediate REMOTE_ADDR matches a configured trusted proxy range. This prevents untrusted clients from spoofing forwarded headers.

The chain is evaluated from right to left, and only a valid public non-proxy IP can be selected.

Why is CF-Connecting-IP ignored?​

CF-Connecting-IP is accepted only when REMOTE_ADDR belongs to the bundled Cloudflare CIDR ranges.

Header presence alone is not enough. If the request did not come through a verified Cloudflare range, the resolver falls back safely.

Are Cloudflare IP ranges updated automatically?​

No. The current implementation uses a bundled reviewed snapshot of Cloudflare ranges. It does not download Cloudflare ranges during login.

The bundled ranges should be reviewed and refreshed during release and maintenance cycles.

Can ip_address be empty?​

Yes. If no valid public client IP can be resolved, the event can be recorded with an empty IP address. This can be normal in local, private, container, or internal proxy environments.

GeoIP lookup may fail when no public IP is available.

What does Retention Disabled mean?​

Disabled (Automatic Cleanup Off) means automatic login-event cleanup is disabled.

It does not delete existing events and does not prevent new events from accumulating.

What triggers retention cleanup?​

Retention cleanup runs through the WHMCS DailyCronJob hook when normal WHMCS cron invokes daily cron hooks.

It does not run on every page load or login event.

Does retention cleanup delete backups?​

No. Retention cleanup affects live Extendy GeoShield login event rows in the WHMCS database. It does not purge independent database backups, server snapshots, staging copies, or disaster-recovery copies.

Does deactivation delete data?​

No. Deactivation preserves addon data. It is not a full removal operation.

Are provider credentials stored in plain text?​

Provider credentials are stored using the verified WHMCS Local API EncryptPassword / DecryptPassword mechanism and are displayed as masked values in the admin UI.

Why do credential fields appear masked?​

Masking is intentional. The admin UI does not display plaintext provider credentials.

Leaving a credential field empty during save keeps the existing stored value. Use the explicit clear/remove action to remove a stored credential.

Does Extendy GeoShield send telemetry to Extendy LTD?​

The reviewed current addon runtime implementation does not include telemetry reporting to an Extendy-operated service.

This is a statement about the reviewed current implementation, not a permanent promise about all future versions.

Does the current addon perform licence validation calls?​

No. The reviewed current addon runtime implementation does not include licence validation calls.

Does the current addon include manual update checks?​

No. The reviewed current addon runtime implementation does not include manual update availability checks.

Does the Login Events Log prove who logged in?​

No. The Login Events Log records addon event metadata. It does not replace WHMCS authentication records and does not prove a visitor’s identity.

Does GeoIP verify identity?​

No. GeoIP country data is contextual security information only. It does not authenticate a WHMCS User and does not prove that a login is legitimate.

No. The documentation is technical product documentation. Operators should assess their own legal, contractual, privacy, retention, provider, mail transport, and backup obligations.