⚠️ Status: untested. This extension is provided as-is and has not been tested in production. Please feel free to fork, modify, improve, and open pull requests.

Licensed under GNU GPLv3 (see LICENSE).

IP Block - Cloudflare Worker

Edge protection for any site served through Cloudflare. Every request is screened against ip-block.com before it reaches your origin. Because it runs at the edge, it can protect origins you cannot install server code on - including hosted Shopify and Wix stores (see below).

• Runtime: Cloudflare Workers (module syntax fetch handler)
• Tooling: Wrangler v3+
• Decision cache: Workers KV (per-IP)
• Client IP source: CF-Connecting-IP

Files

File	Purpose
src/index.js	The Worker (screen -> cache -> allow/block)
wrangler.toml	Bindings, vars and deploy config
README.md	This document

How it works

1. Reads the real client IP from CF-Connecting-IP.
2. Skips the lookup for whitelisted IPs and when IPBLOCK_ENABLED=false.
3. Checks Workers KV for a cached decision for that IP.
4. On a cache miss, POSTs to https://api.ip-block.com/v1/check with a ~1s timeout and caches the result for IPBLOCK_CACHE_TTL seconds.
5. Blocks only when the API returns {"action":"block"} - returning a 403 (or a redirect). Any error, timeout, non-2xx, or missing action fails open (allows) unless you set IPBLOCK_FAIL_OPEN=false.

Deploy

# 1. Install Wrangler and log in
npm install -g wrangler
wrangler login

# 2. Create the KV namespace for decision caching, then paste the printed id
#    into wrangler.toml under [[kv_namespaces]].
wrangler kv namespace create IPBLOCK_KV

# 3. Edit wrangler.toml: set IPBLOCK_SITE_ID and your route(s).

# 4. Store the API key as a secret (never commit it)
wrangler secret put IPBLOCK_API_KEY

# 5. Publish
wrangler deploy

Configuration

Non-secret values live in [vars] in wrangler.toml; the API key is a secret.

Name	Default	Meaning
IPBLOCK_ENABLED	true	Master on/off switch
IPBLOCK_SITE_ID	-	Your ip-block.com site id
IPBLOCK_API_KEY	- (secret)	Your API key (wrangler secret put)
IPBLOCK_API_URL	https://api.ip-block.com/v1/check	Screening endpoint
IPBLOCK_FAIL_OPEN	true	Allow on error/timeout
IPBLOCK_CACHE_TTL	300	Seconds to cache a per-IP decision
IPBLOCK_TIMEOUT_MS	1000	API timeout (~1s)
IPBLOCK_BLOCK_ACTION	403	403 or redirect
IPBLOCK_REDIRECT_URL	https://www.ip-block.com/blocked.php	Used when block_action=redirect
IPBLOCK_BLOCK_MESSAGE	built-in HTML	Body for the 403 page
IPBLOCK_WHITELIST	empty	Comma-separated IPs to always allow

KV note: Cloudflare enforces a 60-second minimum TTL, so the Worker clamps expirationTtl to at least 60s.

Protecting a Shopify / Wix store fronted by Cloudflare

SaaS platforms like Shopify and Wix do not let you run server-side code, but you can put Cloudflare in front of them and run this Worker:

1. Add your domain (e.g. shop.example.com) to Cloudflare and move the domain's nameservers to Cloudflare (full setup), so traffic is proxied (orange cloud), not just DNS-only.
2. Point the proxied record at your Shopify/Wix hostname (a CNAME to the platform target, per their custom-domain docs). Configure the custom domain inside Shopify/Wix as usual.
3. Deploy this Worker and attach a route for your hostname in wrangler.toml (e.g. { pattern = "shop.example.com/*", zone_name = "example.com" }).

Now every visitor is screened at Cloudflare's edge and only clean traffic is proxied through to the storefront - no code on the SaaS platform required.