@@ -20,17 +20,20 @@ Since this is not a library, this changelog focuses on the changes that are rele
 
 ## [Unreleased]
 
-### Features
+### ⚠️ Breaking Changes
 
-- Added provider presets for client IP headers and support for reading GeoIP data from provider or custom headers
+- Proxy-provided client IP headers are no longer trusted by default. Configure `client_ip_headers` to opt in
 
-### Bug Fixes
+### Features
 
+- Added client IP header presets for Akamai, Cloudflare, CloudFront, Fastly, and Fly
+- Added GeoIP header mappings and presets for Akamai, Cloudflare, CloudFront, Netlify, and Vercel, with MaxMind results taking precedence when available
 - Tracker requests now avoid CORS preflight requests by sending JSON as `text/plain` and the event API accepts tracker JSON regardless of content type
 
 ### Other
 
 - Renamed `trusted_headers` to `client_ip_headers` (the old name remains supported)
+- Removed the redundant `use_forward_headers` option
 
 ## [v1.6.0] - 2026-06-20
 
 
@@ -30,12 +30,6 @@ tokio = { version = "1.53", default-features = false, features = [
 ] }
 tokio-util = { version = "0.7", features = ["io"] }
 
-argon2 = { version = "0.6.0-rc.8", features = [] }
-async-compression = { version = "0.4", default-features = false, features = [
-  "gzip",
-  "tokio"
-] }
-blake3 = { version = "1.8" }
 # encoding
 hex = { version = "0.4" }
 md-5 = { version = "0.11.0" }
@@ -48,10 +42,23 @@ serde_json = { version = "1.0" }
 tokio-tar = { package = "astral-tokio-tar", version = "0.6" }
 zstd = { version = "0.13", default-features = false }
 
+# general
 ahash = "0.8"
+aide = { version = "0.16.0-alpha.4", default-features = false, features = [
+  "axum",
+  "axum-extra-cookie",
+  "axum-extra-headers",
+  "axum-json",
+  "axum-matched-path",
+] }
 anyhow = { version = "1.0" }
-# general
 argh = { version = "0.1", default-features = false, features = ["help"] }
+argon2 = { version = "0.6.0-rc.8", features = [] }
+async-compression = { version = "0.4", default-features = false, features = [
+  "gzip",
+  "tokio"
+] }
+blake3 = { version = "1.8" }
 chrono = { version = "0.4", default-features = false, features = [
   "now",
   "serde",
@@ -67,13 +74,6 @@ rand = { version = "0.10", default-features = false, features = [
 tracing = { version = "0.1", default-features = false, features = ["std"] }
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 
-aide = { version = "0.16.0-alpha.4", default-features = false, features = [
-  "axum",
-  "axum-extra-cookie",
-  "axum-extra-headers",
-  "axum-json",
-  "axum-matched-path",
-] }
 # web
 axum = { version = "0.8", default-features = false, features = [
   "http1",
@@ -89,7 +89,7 @@ axum-extra = { version = "0.12", default-features = false, features = [
 ] }
 headers = "0.4"
 http = "1.5"
-ipnet = "2.12"
+ipnet = { version = "2.12", features = ["serde"] }
 reqwest = { version = "0.13", default-features = false, features = [
   "charset",
   "json",
 
@@ -1,39 +1,35 @@
 base_url = "http://localhost:9042"  # The base URL of the Liwan instance
 listen = 9042  # The port to listen on (http)
 
-# Disable favicon fetching from the DuckDuckGo API.
+# # Disable favicon fetching from the DuckDuckGo API.
 # disable_favicons=false
 
 # # Folder to store the database in (Will be created if it doesn't exist)
 # # defaults to $HOME/.local/share/liwan/data on linux/macos
 # # defaults to ./liwan-data on other platforms
 # data_dir="./liwan-data"
 
-# Trusted client IP headers (used in order).
-# Defaults to all supported headers.
-# Presets: cloudflare, fastly, fly, cloudfront, akamai.
+# # Trusted client IP headers (used in order).
+# # Empty by default, meaning only the direct peer IP is used.
+# # Presets: cloudflare, fastly, fly, cloudfront, akamai.
 # client_ip_headers="cloudflare"
-# Provider presets can be combined with standard or custom headers.
+# # Provider presets can be combined with standard or custom headers.
 # client_ip_headers=["cloudflare", "fly", "X-Forwarded-For", "X-Client-IP"]
 
-# Trusted reverse proxies (IP or CIDR).
-# Empty by default, meaning all proxies are trusted.
+# # Trusted reverse proxies (IP or CIDR).
+# # Empty by default, meaning all proxies are trusted.
 # trusted_proxies=["127.0.0.1", "10.0.0.0/8"]
 
-# Whether to use forwarded IP headers at all.
-# If false, only the direct peer IP is used.
-# use_forward_headers=true
-
-# Hour of day, in the server's local timezone, when visitor grouping salts rotate.
-# Defaults to 4, meaning 4am local time.
+# # Hour of day, in the server's local timezone, when visitor grouping salts rotate.
+# # Defaults to 4, meaning 4am local time.
 # visitor_group_rotation_hour=4
 
 # GeoIp settings (Optional)
 [geoip]
-# Read location data supplied by a trusted proxy.
-# Presets: cloudflare, cloudfront, vercel.
+# # Read location data supplied by a trusted proxy.
+# # Presets: akamai, cloudflare, cloudfront, netlify, vercel.
 # headers="cloudflare"
-# Multiple presets and custom mappings are also supported, in priority order.
+# # Multiple presets and custom mappings are also supported, in priority order.
 # headers=["cloudflare", { country="X-Country", city="X-City" }]
 
 # # MaxMind account ID and license key
@@ -47,6 +43,6 @@ listen = 9042  # The port to listen on (http)
 # maxmind_db_path="./GeoLite2-City.mmdb"
 
 [duckdb]
-# See https://liwan.dev/guides/duckdb
+# # See https://liwan.dev/guides/duckdb for guidance
 # threads=2
 # memory_limit=2G
@@ -88,7 +88,7 @@ impl LiwanGeoIP {
 
         let maxmind_edition = &self.geoip.maxmind_edition;
         let maxmind_account_id =
-            self.geoip.maxmind_account_id.as_deref().ok_or_else(|| anyhow!("MaxMind account ID not found"))?;
+            self.geoip.maxmind_account_id.as_ref().ok_or_else(|| anyhow!("MaxMind account ID not found"))?.to_string();
         let maxmind_license_key =
             self.geoip.maxmind_license_key.as_deref().ok_or_else(|| anyhow!("MaxMind license key not found"))?;
 
@@ -97,7 +97,7 @@ impl LiwanGeoIP {
 
         let mut update = !db_exists;
         if db_exists {
-            match get_latest_md5(maxmind_edition, maxmind_account_id, maxmind_license_key).await {
+            match get_latest_md5(maxmind_edition, &maxmind_account_id, maxmind_license_key).await {
                 Ok(latest_md5) => {
                     if latest_md5 != db_md5 {
                         tracing::info!("GeoIP database outdated, downloading...");
@@ -113,7 +113,7 @@ impl LiwanGeoIP {
         }
 
         if update {
-            let file = match download_maxmind_db(maxmind_edition, maxmind_account_id, maxmind_license_key).await {
+            let file = match download_maxmind_db(maxmind_edition, &maxmind_account_id, maxmind_license_key).await {
                 Ok(file) => file,
                 Err(e) => {
                     tracing::warn!(error = ?e, "Failed to download GeoIP database, skipping update");