Security Overview

WorldIP.io is a production-grade, globally distributed platform that sustains over a billion updates a day across the entire IPv4 address space and answers lookups in under a second. Security is a first-class part of how it is built and run. This page describes, honestly and specifically, the controls we have in place today. We describe the posture we actually operate — we do not claim certifications or audits we have not completed.

All traffic to WorldIP.io is served over HTTPS with TLS 1.2 or higher. The site sits behind Cloudflare, which provides edge TLS termination, a global CDN, and DDoS protection. Plain-HTTP requests are redirected to HTTPS.

Session and authentication cookies are issued with the Secure, HttpOnly, and SameSite=Lax flags, so they are only ever transmitted over HTTPS, are not readable from JavaScript, and are not attached to cross-site requests — closing off the common session-theft and CSRF cookie vectors.

WorldIP.io does not currently take payments, and at no point do we store, transmit, or have access to your payment-card details. When paid API plans launch, card processing will be delegated entirely to a PCI-DSS-compliant payment processor (Stripe); card numbers are entered directly with the processor and never touch our servers. This removes an entire class of sensitive data — cardholder data — from our systems by design.

Accounts use Sign in with Google (OAuth 2.0). We never see, receive, or store your Google password, and we request only your basic profile and email. Because there is no password for us to hold, there is no password database to breach.

Login state is carried in a stateless, HMAC-signed cookie (wio_auth) rather than a server-side session store: each server independently verifies the signature against a shared secret, so a tampered or forged cookie is rejected. Anonymous requests carry no such cookie, which also keeps public pages cacheable at the edge. You can permanently delete your account and all associated data yourself, instantly, from your account page.

Our API is authenticated with least-privilege keys, designed so that a leaked key does the least possible damage:

• Hashed at rest — we store only a SHA-256 hash of each key; the plaintext is never persisted and cannot be recovered from our systems. Incoming keys are matched by hash.
• Scoped — every key is limited to the specific capabilities it needs; a request outside the key’s scope is rejected.
• Rate-limited — each key has its own sliding-window rate limit, enforced independently of other keys and of anonymous traffic.
• Origin- and IP-lockable — a key can be bound to a specific site origin (enforced on browser calls) and/or to an allow-list of caller IP addresses (the strongest lock for server-to-server use).
• Revocable — a key can be disabled instantly, and you can regenerate your key at any time from your account.

Keys may be passed as an Authorization: Bearer <key> header or a ?key= query parameter; the header form is recommended so keys stay out of logs and referrers.

• CSRF protection — state-changing actions (contact form, account changes, key regeneration, deletion) require a CSRF token verified with constant-time comparison, and same-origin checks reject cross-site submissions.
• Adaptive rate-limiting — sliding-window per-IP and per-key limits protect every website and API endpoint from scraping and brute force, backed by an automated anti-abuse firewall that throttles or blocks abusive request patterns.
• Input validation — IP, CIDR, ASN and domain inputs are strictly validated before use, and database access uses parameterized queries throughout.
• Layered form defences — public forms combine a hidden honeypot, a minimum dwell time, a JavaScript challenge, referrer verification, and content heuristics to stop automated spam without tracking you.
• Separated administration — the public site carries no admin surface; operations run on a separate control panel reachable only from our private network, so admin functionality is not exposed to the internet.

WorldIP.io runs on infrastructure we operate across North America, Europe and Asia-Pacific, interconnected over an encrypted WireGuard mesh. Inter-service traffic travels over this private network rather than the public internet, and management interfaces are not exposed publicly.

Operator access is key-based and least-privilege: administrative access uses SSH keys (no shared passwords) and is restricted to authorized operators reaching hosts through the private mesh. Public-facing components are firewalled to accept only the traffic they need.

Our data is compiled only from authoritative, public sources, and we publish where each field comes from so results are auditable:

• MaxMind GeoLite2 — IP-to-country/-city/-ASN mappings.
• IANA + RIR delegation files — ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC allocation and transfer records.
• ipinfo Lite — supplementary ASN/country coverage.
• Public DNS (PTR) + GRIP forward DNS — reverse and forward hostname associations.
• RIPE RIS routing + RPKI — live BGP announcements, origin ASNs and route validity.
• Public RDAP / WHOIS and curated threat-intelligence blocklists — ownership detail and reputation signals.

We only resolve public DNS and routing data. We do not port-scan, probe services, or make application-level connections to the addresses we index. Full licensing and attribution is documented on our data sources & methodology page.

The data we publish describes networks, not identified people. The personal data we do hold is minimized: web lookups need no account; where we use your IP for rate-limiting we store only a one-way hash; API keys are hashed; and we do not sell personal information. See our Privacy Policy for the full detail on what we collect and your rights.

We believe in being straight with you about what we have and haven’t done. WorldIP.io follows the security practices described on this page, but we do not currently hold formal third-party certifications such as SOC 2 or ISO 27001, and we have not undergone an external security audit. We would rather state that plainly than imply assurances we cannot back up. As the service and its paid tiers mature, we intend to formalize and expand these controls, and we will update this page when we do.

If you believe you have found a security vulnerability in WorldIP.io, we want to hear from you. Email security@worldip.io with enough detail to reproduce the issue. We will acknowledge your report, investigate, and keep you updated on remediation.

Good-faith safe harbor. If you make a genuine, good-faith effort to comply with this policy during your research, we will not pursue or support legal action against you, and we will work with you to understand and resolve the issue quickly. We simply ask that you:

• give us a reasonable opportunity to fix the issue before disclosing it publicly;
• avoid privacy violations, data destruction, service degradation, and access to or modification of data that is not yours;
• use only your own accounts and test data, and stop at the point of demonstrating the vulnerability rather than exploiting it further;
• do not run automated high-volume scans, denial-of-service tests, or social-engineering / physical attacks against our staff or infrastructure.

We do not currently run a paid bug-bounty program, but we are grateful for responsible reports and will happily credit researchers who would like to be acknowledged.

WorldIP.io operates a reverse-DNS (PTR) scanner that resolves public DNS records. If you have questions about traffic you have seen from our scanner, or want your network excluded, email abuse@worldip.io or read our scanner information page, which explains exactly what we do and don’t do.