Skip to content
IP Location Block
Home Pricing Articles Docs Changelog Contact My Account Get Started

Cloudflare, proxies, and real visitor IPs

Updated Aug 24, 2026

Shared guide

When a CDN, reverse proxy, or load balancer sits in front of WordPress, PHP sees the proxy in REMOTE_ADDR. Every rule then evaluates the wrong address, and no provider can fix that. Tell the plugin which request header carries the real visitor address first, then tune your rules.

Symptoms

  • Visitors from blocked countries reach the site, and visitors you allow are blocked.
  • Validation logs show the same handful of addresses over and over.
  • Every request geolocates to the country of a data center rather than to your audience.

Set the $_SERVER keys

Open Settings > IP Location Block > Advanced > Validation rules and behavior > Proxy and IP overrides and fill in $_SERVER keys for extra IP addresses. It takes a comma separated list of upper case $_SERVER names with no spaces.

HTTP_CF_CONNECTING_IP

In the Classic view, the field placeholder names a key that is actually present on your current request, which is a useful hint about what your stack sends.

How the value is evaluated

  1. Keys are read in the order you list them.
  2. For a key that is present, its value is split on commas and read from right to left.
  3. The first address that is not private or reserved becomes the client address.
  4. If no listed key yields a public address, REMOTE_ADDR is used.

Every public address found in those headers is validated, not only the one that is chosen, and a block on any of them blocks the request. That is another reason to list only the keys your proxy actually sets.

Cloudflare

Cloudflare sets CF-Connecting-IP to the visitor address on every proxied request, so HTTP_CF_CONNECTING_IP on its own is the correct value. Adding HTTP_X_FORWARDED_FOR as well is unnecessary and widens what a caller can influence.

Many managed hosts, and Cloudflare’s own origin module, already rewrite REMOTE_ADDR for proxied traffic. If yours does, leave the field empty. Check Validation logs before changing anything.

These are ordinary request headers. If requests can reach your origin without passing through the proxy, a caller can set them freely and choose an apparent location. Restrict the origin to your proxy’s addresses, and list only keys the proxy always overwrites.

Other common setups

Setup Typical key Notes
Cloudflare HTTP_CF_CONNECTING_IP One visitor address, set on every proxied request.
Nginx or Varnish in front of Apache HTTP_X_REAL_IP Only if the proxy configuration sets it explicitly.
Generic reverse proxy or load balancer HTTP_X_FORWARDED_FOR A list of hops. The rightmost public address is used.
Host rewrites REMOTE_ADDR none Leave the field empty.

Verify the result

  1. Purge caches, sign out, and make one request from a location you know.
  2. Open Validation logs and read the address recorded for it. Your own address means the key is right; the proxy’s address means it is wrong or missing.
  3. Look that address up on the Search tab to confirm the country your provider returns.
  4. Run Diagnostics again once the address is correct.

If lookups still fail after the address is right, the problem is the provider rather than the proxy. Continue in Troubleshooting.