Visitor IP detection

When Security Ninja blocks an IP, checks a country rule, or writes a line to the Events or Visitor Log, it needs to know which IP belongs to the visitor. On sites behind Cloudflare, nginx, or a load balancer, the address PHP sees first is not always the visitor’s real IP.

Visitor IP detection lets you choose how that address is resolved. Trusted proxy CIDRs tells Automatic mode which reverse-proxy IPs to trust besides Cloudflare. Both settings are available in the free plugin and in Pro. They were added in Security Ninja 5.303.

Where to find it

1. Go to Security Ninja → Firewall.
2. Open the Settings tab.
3. Find Visitor IP detection (dropdown, short description, Your IP with current setting, and Preview all methods).
4. Directly below it, find Trusted proxy CIDRs.

On the free build, these controls sit after Filter Suspicious Queries and before the Upgrade to Pro box. On Pro, they appear later on the Settings tab, after Block IP Network and before country blocking.

The screenshot above is from a local dev site (127.0.0.1 / ::1). On a live site behind a proxy, open Preview all methods and pick the mode that shows your real public IP. If Automatic still shows the proxy, add that IP under Trusted proxy CIDRs.

What it affects

The resolved IP is used for:

• Manual and automatic IP bans
• Whitelist and blacklist rules (including CIDR ranges)
• Country blocking lookups
• Login protection and auto-ban rules
• 404 Guard
• WooCommerce rate limits and coupon protection (Pro)
• Firewall Events and the Visitor Log (Pro)

Default mode is Automatic (recommended).

Detection modes

Automatic (recommended)

Default. Trusts Cloudflare's CF-Connecting-IP only when REMOTE_ADDR is a known Cloudflare proxy IP. If REMOTE_ADDR matches a CIDR in Trusted proxy CIDRs, it uses X-Forwarded-For (then X-Real-IP). Otherwise it uses REMOTE_ADDR. Good for mixed or unknown setups.

REMOTE_ADDR only

Direct connection to the server with no trusted reverse proxy. Common on a plain VPS.

Cloudflare CF-Connecting-IP

Site is always proxied through Cloudflare. Trusts the visitor header; falls back to REMOTE_ADDR if the header is missing.

X-Forwarded-For

nginx, HAProxy, or another load balancer you control sets this header. Uses the first valid IP in the list; falls back to REMOTE_ADDR.

X-Real-IP

Same idea for stacks that set X-Real-IP instead. Falls back to REMOTE_ADDR.

If the saved value is missing or invalid, Security Ninja falls back to Automatic.

X-Forwarded-For and X-Real-IP trust those headers on every request. Prefer Automatic plus Trusted proxy CIDRs unless PHP only ever sees traffic from a proxy you control.

Trusted proxy CIDRs

Use this list when Automatic is selected and the site sits behind a load balancer or reverse proxy that is not Cloudflare. Cloudflare ranges are already known. You do not add those here.

1. Keep Visitor IP detection on Automatic (recommended).
2. Add your proxy’s egress IPs or CIDRs, one per line (for example 192.0.2.10 or 203.0.113.0/24).
3. Save settings.
4. Confirm Your IP with current setting shows the real visitor IP, not the proxy.

Limits:

• Maximum 32 entries.
• Open ranges such as 0.0.0.0/0 and ::/0 are ignored.
• Add only IPs your own proxy uses to reach PHP. Do not list public visitor ranges.

Automatic then reads X-Forwarded-For (or X-Real-IP) only when REMOTE_ADDR matches this list. Spoofed headers from a client that talks to PHP directly are ignored.

How to pick the right mode

1. Open Preview all methods under the dropdown.
2. Compare what each mode would resolve to on your current request.
3. Choose the mode that shows your real public IP (or the IP you expect for testing).
4. If Automatic still shows the proxy IP, add that proxy under Trusted proxy CIDRs, save, and check again.
5. Save settings and confirm Your IP with current setting looks right.

If every method shows 127.0.0.1 or ::1, you are probably on localhost. That is normal for Local WP, Docker, or similar. Test again on staging or production.

Common situations

Site behind Cloudflare but bans show Cloudflare IPs

Try Automatic first. If the site is always proxied through Cloudflare and Automatic still looks wrong, switch to Cloudflare CF-Connecting-IP.

Site behind nginx or a load balancer

Prefer Automatic and add the proxy IPs under Trusted proxy CIDRs. Only switch to X-Forwarded-For or X-Real-IP when PHP receives requests exclusively from a reverse proxy you control that overwrites the header. Do not enable those modes on a host where visitors can reach PHP directly and spoof headers.

Origin-only VPS (no proxy)

Use REMOTE_ADDR only. Leave Trusted proxy CIDRs empty.

Import, export, and MainWP

Exports from older sites that do not include these keys import as Automatic with an empty proxy list. Older MainWP child plugins ignore unknown keys safely.

For MainWP bulk copy, the child site needs Security Ninja 5.303 or newer for ip_source and trusted_proxy_cidrs to apply. See Copy settings from MainWP.

Developers can override the resolved address with the wf_sn_client_ip filter, or add extra proxy ranges with wf_sn_trusted_proxy_cidrs.

Related

• How to use the firewall
• Filter Suspicious Queries
• How to blacklist an IP
• How to block a country
• Visitor Log
• Import and export