Security, Abuse & Privacy

IP Address

Definition

An IP address is the destination label of the internet. IPv4 addresses are 32 bits, written as four numbers up to 255 separated by dots, which gives about 4.3 billion of them — long since exhausted. IPv6 addresses are 128 bits, written as eight groups of hexadecimal digits separated by colons, and there are enough that the shortage stops being a concern. Most home and mobile connections get an address that changes, and many share one public address among hundreds of subscribers through carrier-grade NAT, so an address identifies a connection at a moment rather than a person for all time. Under the GDPR an IP address is nonetheless treated as personal data, because the holder of the connection can be identified with the help of a party who holds the records.

Why It Matters

Almost everything a host knows about a visitor starts here. Country-level analytics, rate limiting, abuse blocking and geoblocking all read the same field, and none of them work without it. The awkward part is that the same field is regulated: storing raw addresses turns an ordinary traffic log into a store of personal data, with the retention and disclosure duties that follow. That is why privacy-minded analytics, including the cookie-free counting on 99helpers, derive what they need from the address and then discard it rather than filing it away. The alternative is a growing archive of who visited what, which nobody asked for and someone eventually has to answer for.

How It Works

A browser resolves a hostname through DNS to an address — an A record for IPv4, an AAAA record for IPv6 — then opens a connection to it. The server sees the source address of that connection, but behind a proxy or a CDN that address belongs to the edge node, and the visitor's own address travels in a header such as X-Forwarded-For or a Forwarded field. Geolocation works by looking the address up in a database of allocations, which is reliable at country level and vague below it; city guesses are often wrong by a long way, and a VPN moves the answer to another continent. Where the address must be counted but not kept, the usual technique is to hash it together with a salt that rotates daily, which lets a system recognise repeat requests within a day and lose the ability to link them afterwards.

Real-World Example

A charity publishes an annual report at trustfund-report.99helpers.site and wants to know which countries read it before the board meeting. The edge derives a country from each visitor address, adds one to a counter, and stores no address at all, so the report shows 41 per cent from the UK and 22 per cent from Ireland with nothing personal behind it. When a single address later pulls the PDF two thousand times in an hour, rate limiting acts on it in the moment without that address ever being written down. Both needs are met, and neither leaves a file of visitors behind.

Common Mistakes

  • Treating an address as a person — shared office connections and mobile carrier NAT put many people behind one address
  • Storing raw addresses in an application database because they were free to collect — that is personal data sitting in a table nobody is managing
  • Trusting city-level geolocation for anything that matters — country is usually right, the city frequently is not

Related Terms

Put a file online in seconds

Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.

Host a file free →