---
title: Filter wf_sn_trusted_proxy_cidrs
canonical: https://wpsecurityninja.com/docs/filters-hooks/wf_sn_trusted_proxy_cidrs/
---
**Visitor IP detection** in Automatic mode trusts Cloudflare proxy ranges by default. For another load balancer or reverse proxy, you add its IPs under **Trusted proxy CIDRs** on **Firewall → Settings**.

The `wf_sn_trusted_proxy_cidrs` filter runs after that list is sanitized (invalid lines and open ranges such as `0.0.0.0/0` are already removed). Use it to add ranges from code instead of the settings field, or to merge a shared list across sites.

User-facing guide: [Visitor IP detection](https://wpsecurityninja.com/docs/firewall/visitor-ip-detection/).

## Filter signature

```php
apply_filters( 'wf_sn_trusted_proxy_cidrs', $cidrs );
```

| Parameter | Type | Description |
|---|---|---|
| `$cidrs` | string[] | Sanitized CIDR or single-IP entries from settings |

Return an array of CIDR or IP strings. Keep the list short and specific. The settings field caps stored entries at 32. The filter can add more, but each extra range widens who can present `X-Forwarded-For` or `X-Real-IP` in Automatic mode.

## Example: trust an internal load balancer

```php
add_filter( 'wf_sn_trusted_proxy_cidrs', function ( $cidrs ) {
    $cidrs[] = '203.0.113.10/32';
    $cidrs[] = '198.51.100.0/24';
    return array_values( array_unique( $cidrs ) );
} );
```

Only add IPs your own proxy uses to reach PHP. Do not trust client-supplied headers on the public internet.

To override the resolved visitor IP after detection runs, use [`wf_sn_client_ip`](https://wpsecurityninja.com/docs/filters-hooks/wf_sn_client_ip/).

> Not sure how to add this code? See [Add custom code to your website](https://wpsecurityninja.com/docs/installation-and-usage/custom-code-website/).