How to Detect If a User Is Using a VPN with JavaScript

In today's world of online privacy tools, VPNs (Virtual Private Networks) have become very common. If you're building an application, especially one involving security, fraud prevention, or geo-restricted content, you might wonder.

"Can I detect if a user is using a VPN?"

While it's tricky to detect VPNs purely from frontend JavaScript, one simple method is by using IP intelligence services like ipinfo.io. In this article, I'll show you how to detect VPN or proxy usage using just a few lines of JavaScript.

Basic Idea

Browsers don't directly expose network information like IP addresses for security reasons.So to find the user's IP (and whether it's associated with a VPN or proxy), we can call an external API like ipinfo.io, which provides detailed IP data, including privacy information.

Example Code

Here’s a simple function that checks if a user is likely using a VPN or a proxy:

async function checkVpnUsage() {
  const res = await fetch('https://ipinfo.io/json?token=YOUR_TOKEN');
  const data = await res.json();

  console.log('IP Info:', data);

  // Some services provide `privacy` or `proxy` fields
  if (data.privacy && (data.privacy.vpn || data.privacy.proxy)) {
    console.log('User is likely using a VPN or proxy.');
  } else {
    console.log('No VPN/proxy detected.');
  }
}

checkVpnUsage();

How It Works

• Fetch IP Data:We use fetch() to get JSON data from ipinfo’s API.

• Check Privacy Fields:If the response contains a privacy object, and the vpn or proxy field is true, we assume the user is behind a VPN or proxy server.

• Log the Result:We simply print the result to the console for now.

A Sample API Response

When you call https://ipinfo.io/json, you’ll get a response like this:

{
  "ip": "8.8.8.8",
  "city": "Mountain View",
  "region": "California",
  "country": "US",
  "org": "Google LLC",
  "privacy": {
    "vpn": true,
    "proxy": false,
    "relay": false,
    "hosting": true,
    "service": "Google Cloud"
  }
}

Notice the privacy object — it tells you if the IP is linked to VPNs, proxies, or hosting services.

Things to Keep in Mind

• You Need an API Token:Sign up at ipinfo.io to get a free token. Free plans usually allow around 1,000 API calls per month.

• Detection Isn't Perfect:Some modern VPNs use residential IP addresses, making them harder to detect.

• Consider Backend Validation:It’s safer to perform this check on the server-side too, to avoid users tampering with frontend JavaScript.

• Respect Privacy:Be clear with users if you collect or act on their IP address or location.

Things to Keep in Mind

• You Need an API Token:Sign up at ipinfo.io to get a free token. Free plans usually allow around 1,000 API calls per month.

• Detection Isn't Perfect:Some modern VPNs use residential IP addresses, making them harder to detect.

• Consider Backend Validation:It’s safer to perform this check on the server-side too, to avoid users tampering with frontend JavaScript.

• Respect Privacy:Be clear with users if you collect or act on their IP address or location.

Example:

if (data.privacy && (data.privacy.vpn || data.privacy.proxy)) {
  alert('We detected a VPN or proxy. For a better experience, please disable it.');
}

Their you go, I hope this short read gave you some insights 😁 cheers! 🍻

If you enjoy this article and would like to show your support, you can easily do so by buying me a coffee. Your contribution is greatly appreciated!