Skip to content

Firewall

Real visitor IP (trusted proxy)

Every planAbout Firewall

Tells Stack Guard how to find a visitor's real internet address when your site sits behind Cloudflare, a load balancer or another proxy.

What it does

Behind a proxy, every visit seems to come from the proxy's own address. The proxy passes the real address along in a header. This setting says which header to trust, and only from which proxies.

Auto (recommended) recognises Cloudflare and private networks by itself. Direct connection is for sites with no proxy. Cloudflare only trusts Cloudflare alone. Custom proxy lets you name the header and list your proxy addresses.

Why it matters

Lockouts, bans, country blocking and the activity log all depend on the right address. Get it wrong and you might lock out every visitor at once, or let an attacker fake any address they like.

Set it up

  1. Go to the Firewall tab, section Real visitor IP.
  2. Look at the detection read-out: it shows the address Stack Guard sees for you right now. Compare it with what a "what is my IP" site shows.
  3. Leave Mode on Auto unless they differ. With your own proxy, choose Custom proxy, pick the Forwarding header your proxy sends, and list the proxy's addresses in Proxy addresses.
  4. Click Save Changes and check the read-out again.

Which plan includes it

This setting is in every plan.

How it works, for developers
  • Auto uses CF-Connecting-IP only when the connection comes from a Cloudflare address; otherwise it reads X-Forwarded-For from the right, skipping trusted private and Cloudflare hops. Direct uses REMOTE_ADDR only.
  • Custom headers offered: X-Forwarded-For, X-Real-IP, True-Client-IP, CF-Connecting-IP. Headers from untrusted sources are ignored, so they cannot be faked.
  • Cloudflare's address ranges are kept in the option smg_cloudflare_ips and refreshed weekly by the smg_refresh_cloudflare_ips task.
  • Settings: smg_trusted_proxy_mode, smg_trusted_proxy_header, smg_trusted_proxy_ips. Not included in settings exports, because proxies differ per site.

Quick answers about real visitor ip (trusted proxy)

What does Real visitor IP (trusted proxy) do in Stack Guard?

Behind a proxy, every visit seems to come from the proxy's own address. The proxy passes the real address along in a header. This setting says which header to trust, and only from which proxies. Auto (recommended) recognises Cloudflare and private networks by itself. Direct connection is for sites with no proxy. Cloudflare only trusts Cloudflare alone. Custom proxy lets you name the header and list your proxy addresses.

Why use real visitor ip (trusted proxy) on a WordPress site?

Lockouts, bans, country blocking and the activity log all depend on the right address. Get it wrong and you might lock out every visitor at once, or let an attacker fake any address they like.

How do I set up real visitor ip (trusted proxy)?

1. Go to the Firewall tab, section Real visitor IP. 2. Look at the detection read-out: it shows the address Stack Guard sees for you right now. Compare it with what a "what is my IP" site shows. 3. Leave Mode on Auto unless they differ. With your own proxy, choose Custom proxy, pick the Forwarding header your proxy sends, and list the proxy's addresses in Proxy addresses. 4. Click Save Changes and check the read-out again.

Which Stack Guard plan includes real visitor ip (trusted proxy)?

This setting is in every plan.

More in Firewall

Not running Stack Guard yet? It is free.

Download Free