For whoever runs the site, codes in it or has a VPS. With the site orange on Cloudflare, what connects to the server is Cloudflare, not the visitor. Unless something translates that, access logs, forms, security plugins and IP blocks see Cloudflare addresses instead of the real one. The true address arrives in a header, CF-Connecting-IP (and also in X-Forwarded-For). The job is getting the server or the application to read it, but only when the request really comes from Cloudflare.
Where you notice it
| Symptom |
Why |
| Comments, orders or login attempts show only a few addresses, always the same ones |
The application records the address of whoever connects, and that is Cloudflare. |
| An IP block in .htaccess does not stop the visitor |
The rule compares against the address the server sees. If that is Cloudflare’s, it never matches: blocking an IP address. |
| A security plugin blocks lots of people at once |
It blocked a Cloudflare address, and many visitors sit behind that address. |
| The visitor’s country is wrong, or always the same |
Geolocation is using Cloudflare’s address instead of the visitor’s. |
| The logs already show varied, real addresses |
The server already translates the header. Nothing to do beyond confirming with the test below. |
Seeing what your site sees, and fixing it
| 1 |
Create a temporary test file in the site folder, for example ip-test.php, with the code below.
|
|
| 2 |
Open it in the browser and compare both lines with your public IP (how to find your public IP). If REMOTE_ADDR is already yours, the server translates the header and applications see the right address. If REMOTE_ADDR is something else and CF-Connecting-IP is yours, the translation is missing.
|
|
| 3 |
Delete the file straight away. Forgotten diagnostic files on a site are an open door.
|
|
| 4 |
On shared hosting, the translation happens on the server and is not in your hands: if the test shows Cloudflare’s address, tell us the domain. Meanwhile, in security and form plugins look for the option that chooses where the visitor’s address is read from, and pick the Cloudflare header only if the site really is behind it.
|
|
| 5 |
On a VPS or dedicated server, the translation is done in the web server, using Cloudflare’s official address list (cloudflare.com/ips): in Apache with mod_remoteip, in Nginx with the real_ip module, in LiteSpeed with the option to use the client IP from the header. The examples follow the test code.
|
|
| 6 |
To block a visitor while the site is orange, block them at Cloudflare, in the IP access rules, where the real address is known.
|
|
The test file (PHP):
<?php
echo 'REMOTE_ADDR: ' . htmlspecialchars($_SERVER['REMOTE_ADDR']) . '<br>';
echo 'CF-Connecting-IP: ' . htmlspecialchars($_SERVER['HTTP_CF_CONNECTING_IP'] ?? '-');
On a VPS, the core of the configuration (replace the part between < > with each range from the official list, one line per range):
# Apache (mod_remoteip)
RemoteIPHeader CF-Connecting-IP
RemoteIPTrustedProxy <one range from cloudflare.com/ips>
# Nginx (one set_real_ip_from line per range)
real_ip_header CF-Connecting-IP;
set_real_ip_from <one range from cloudflare.com/ips>;
|
Never accept the header from just anywhere. Anyone can send a made-up CF-Connecting-IP or X-Forwarded-For straight to the server. If the application takes it without checking the request came from a Cloudflare address, an attacker picks whatever IP they like and walks past blocks and limits. That is why the VPS settings carry the list of trusted addresses.
|
|
When asking for help with blocks or logs, say up front that you use Cloudflare. If the server firewall blocked someone, the address to unblock is the visitor’s, not Cloudflare’s: why your IP gets blocked by the firewall.
|
|
Not sure whether your site sees the real address? Tell us the domain and what the test file showed.
Open a support ticket
|
RECOMMENDED PRODUCT Web hosting with cPanel Domain and SSL included, daily backups and the panel you already know. from $5.36/mo (3-year plan, with coupon) See plans |
Português
English
