The firewall resolves a visitor IP using Visitor IP detection (auto, remote_addr, cf_connecting_ip, x_forwarded_for, or x_real_ip). In Automatic mode it also uses Trusted proxy CIDRs (and Cloudflare ranges) before reading proxy headers. After that, the result passes through wf_sn_client_ip so you can adjust it for custom proxies.

User-facing guide: Visitor IP detection. Trusted proxy list from code: wf_sn_trusted_proxy_cidrs.

Filter signature

apply_filters( 'wf_sn_client_ip', $resolved, $source, $remote_addr );

Parameter	Type	Description
`$resolved`	string	IP chosen by the active detection mode
`$source`	string	Mode key (for example `auto`, `x_forwarded_for`)
`$remote_addr`	string	Raw `REMOTE_ADDR`

Return a valid IP string. Invalid values can make the firewall treat the visitor as unknown.

Example: trust a custom header on an internal proxy

add_filter( 'wf_sn_client_ip', function ( $resolved, $source, $remote_addr ) {
    if ( ! empty( $_SERVER['HTTP_X_SN_REAL_IP'] ) ) {
        $custom = sanitize_text_field( wp_unslash( $_SERVER['HTTP_X_SN_REAL_IP'] ) );
        if ( filter_var( $custom, FILTER_VALIDATE_IP ) ) {
            return $custom;
        }
    }
    return $resolved;
}, 10, 3 );

Only use custom header logic when a reverse proxy you control sets the header. Do not trust client-supplied headers on the public internet.

Not sure how to add this code? See Add custom code to your website.

Filter wf_sn_client_ip

Filter signature

Example: trust a custom header on an internal proxy