Best practices to restrict website to geo location

Question

What are best practices to restrict a website, which is also used as a frontend for a container-App for smartphones, to a specific geo location?

There are obvious methods like:

• Check IP from visitor and map to geo location
• Ask the visitor to select a specific country
• Use the location provided by GPS/Glonass

Are there further best practices to extend the list? The goal is to implement as much techniques as possible.

The techniques don't have to be hacker-proof. I'm fully aware that any of the methods above can easily be spoofed.

Answer 1

The methods you have already outlined are the best and most practical way to identify the country that a user is in however in the interest of a complete answer I will add that no method currently available for identifying the country of a user is foolproof and I will use Netflix for this example. Netflix, which has a relatively large budget for network operations, has struggled for years with restricting access to content based on geographic area. IP filtering works to a degree but bypassing IP filtering is as simple as paying a few dollars per month for a VPN service that will allow you to appear as though you are in the allowed geographic region. Asking the user to select their country is useless as all it takes is for the user to select a different country and there is no way to validate this. As for GPS validation this only works on mobile devices and before you can access that data the user needs to agree to grant your app access to their location data and the user can quite easily deny this or even download a free browser to their computer or mobile device that allows them to manually specify the location thereby bypassing all the filters that have been implemented.

Basically no matter how much you try to implement location filters they will be bypassed very quickly and the harder you try to restrict access based on geography the more you will get users from other locations accessing your services. Practically speaking it is better to limit the use of the application you are developing to the geographic area you are targeting and simply make it useless outside that area rather than trying to restrict it to a specific area.