Some bots try to mimic real users by faking browser language or country. To counter this, BotBlocker includes an optional GeoIP Language Mismatch filter that flags visitors whose declared browser language doesn’t match their country of origin.
How GeoIP Language Mismatch Detection Works
When this option is enabled, BotBlocker checks two things for every visitor:
- The browser’s Accept-Language header
- The detected country via GeoIP lookup
If the language and the country are totally unrelated, the visitor is flagged. For example, a visitor from France using only Chinese or Russian in Accept-Language would trigger the filter.
How the Accept-Language Header Is Read
The browser sends a list of languages in order of preference: de-CH,de;q=0.9,en;q=0.8. The first language counts as the main one, and the q value sets the weight of the rest.
The filter reads the main language and compares it with the country. An empty header or a missing one is a signal too: a real browser almost always sends at least one language.
Where the Country Comes From
The country comes from a GeoIP database matched to the IP address. Private ranges (10.0.0.0/8, 192.168.0.0/16) have no country, and the filter leaves those requests alone.
If the site sits behind a CDN or reverse proxy, check that the country is taken from the visitor’s IP and not from the proxy address. Otherwise all traffic looks like one country and the check loses its point.
Considering Multilingual Countries
Some countries have more than one widely used language. BotBlocker takes this into account. For instance:
- Switzerland: German, French, Italian
- Belgium: Dutch, French, German
- Canada: English, French
The filter uses a reference list of accepted languages per country, reducing the risk of false positives for legitimate multilingual visitors. Each country can allow several languages.
False Positives
The filter goes wrong where language and country differ for a good reason:
- the visitor is on a VPN or a corporate proxy in another country;
- an expat or a tourist keeps the browser in their native language;
- someone set the browser language by hand;
- a company hands out devices with one language for every office.
That is why an international site should not turn the filter on by default. Run it in logging mode first.
When to Use This Option
This is an advanced setting and should be used with care:
- It suits projects where most visitors are local, and language and country mismatches are rare.
- For international stores, news portals, or sites with many travelers and expats, this filter can trigger on genuine users.
Admins can choose the action for mismatches: block, show a captcha, or just log the event for further analysis.
How to Enable GeoIP Language Mismatch Filtering in BotBlocker
- Open BotBlocker settings
- Find the GeoIP Language Mismatch option
- Pick the action: log, captcha, or block
- Turn on the filter
- Save settings
What to Watch in the Log
Turn on logging for a day or two and see who the filter marked. If real customers show up there, add their language to the country list or switch the action to captcha.
Check visitors from countries with many foreign residents and tourists separately: the UAE, Singapore, resort regions. Language and country mismatch is more common there.
FAQ
Will this block tourists or expats?
It might challenge or log them, depending on your settings. Always check analytics before making the filter strict.
Is this setting safe for multilingual sites?
Use caution and allow additional languages for countries with diverse populations.
Does this affect speed?
The check is lightweight and has negligible performance impact.
What if a real customer gets flagged?
Check their language and country. If the pair is unusual, add the language to the allowed list for that country or keep the captcha instead of a block.
Do I need a separate GeoIP service?
No. The country comes from the GeoIP database that ships with the checks.