How can we help?

Search for answers or browse our knowledge base.

Table of Contents

WP Activity Log support for Reverse Proxies & Web Application Firewalls

WP Activity Log can be configured to automatically retrieve a WordPress user’s originating IP address even if WordPress is running behind a reverse proxy, web application firewall, or load balancers. The originating IP will then be shown in the WordPress activity log as the user’s IP.

This article explains how WP Activity Log can retrieve the originating WordPress user’s IP Address, and not that of the proxy, firewall or load balancer.

WordPress and Reverse Proxy or Firewall Setup

In setups with a reverse proxy, load balancer, or web application firewall, the WordPress server typically sits behind the proxy. Therefore, users never communicate directly with WordPress. Instead, users communicate with the reverse proxy and the proxy communications with WordPress, as illustrated in the image below.

Typical WordPress and Reverse Proxy Setup Diagram

Hence, in such a setup, WP Activity Log sees all the requests originating from the reverse proxy, which in this case is 192.168.2.15.

In this example, all events in the activity log will list 192.168.2.15 as the originating IP address. To record the originating WordPress user IP address, enable the option in the Reverse Proxy/Firewall Options as explained below.

Recording the originating IP Address in the WordPress activity log

To configure WP Activity Log to record the true originating IP address:

  1. Navigate to WP Activity Log > Settings
  2. Scroll down to the Is your website running behind a firewall or reverse proxy? section
  3. Check the Yes radio button, then click on the Save Changes button at the end of the page.

Note: If after applying this setting WP Activity Log still shows the proxy/firewall/load balancer IP, enable the Filter internal IP address from the proxy headers setting.

WP Activity Log Reverse Proxy and WAF Settings

Important note: Once the Reverse Proxy/Firewall setting is enabled, WP Activity Log will start recording the IP address from a different set of HTTP headers, which are used by proxy servers, load balancers, and firewalls. As such, this setting cannot be applied retroactively to past activities.

How the WordPress running behind a firewall or reverse proxy setting works

When the reverse Proxy/Firewall Options setting is set to Yes, the plugin retrieves users’ IP addresses from any of the below headers. In doing so, it reports the IP address of the user and not that of the firewall or proxy:

  • HTTP_CLIENT_IP
  • HTTP_X_FORWARDED_FOR
  • HTTP_X_ORIGINAL_FORWARDED_FOR
  • HTTP_X_FORWARDED
  • HTTP_X_CLUSTER_CLIENT_IP
  • HTTP_FORWARDED_FOR
  • HTTP_FORWARDED
  • REMOTE_ADDR
  • HTTP_CF-Connecting-IP (used by Cloudflare)
  • HTTP_TRUE_CLIENT_IP (used by Cloudflare)

These headers are used by proxy servers, firewalls, and load balancers to identify the originating IP address of a client. The below screenshot shows the headers of a connection being forwarded via a reverse proxy:

follow tcp stream

By default, when the setting is enabled, WP Activity Log reports the first IP address from the left as the originating one. This is in compliance with the relevant RFC standards.

Note: WP Activity Log still stores all IP addresses in the headers as explained in the section Retrieving all IP addresses reported in the HTTP Headers.

In some cases, however, the connection between a WordPress user and a WordPress website can be routed through several network hops. In such cases, the header will include multiple IP addresses. WP Activity Log can work around this, as explained in the next section.

Filter Internal IP Addresses Plugin Setting

By enabling the option Filter internal IP addresses, WP Activity Log plugin will not report the end user IP address should it be an internal IP address.

This option has been implemented because, in some cases, there is the possibility that an internal IP is reported in the HTTP headers rather than a public IP address.

Retrieving All IP Addresses Reported in HTTP Headers

When the Reverse Proxy/Firewall Option is enabled, WP Activity Log records all of the IP addresses specified in the HTTP header. However, it only displays the first one from the left since this should be the WordPress user’s originating IP address as per the RFCs.

That being said, there might be cases where some servers do not follow the RFC requirements and change the order of the IP addresses in the HTTP header. In such situations, should you wish to see all the IP addresses reported in the HTTP headers, follow the below procedure:

  1. Navigate to WP Activity Log > Log viewer
  2. Click on the More details… button of the activity for which you would like to see all the data
  3. Look for the OtherIPs node as highlighted in the screenshot below
Click the More details button in the Log Viewer to see other IPs

From the above screenshot, you can notice the HTTP_X_FORWARDED_FOR header, which tells us the originating IP. This is the same IP listed in the activity log. You can also notice the proxy’s IP address in the REMOTE_ADDR header, which in this example is 192.168.188.74.

 Boost your sites’ security and management! Download our free eBook on WordPress oversight.

Uploading WP 2FA as a zip file in WordPress
WP 2FA in the WordPress plugin repository
Close

Installing WP 2FA Free

Congratulations on taking the first step towards enhancing your WordPress site's security with WP 2FA Free! You're now on your way to protecting your valuable data and ensuring peace of mind. No coding or technical knowledge is required.

 

Below are two ways to install WP 2FA on your website:

Go to your plugin dashboard on your site, then go to "Add New", and then search for WP 2FA.

Download the WP 2FA plugin zip, then select upload in your plugin dashboard under "Add New".

OPTION 1

OPTION 2

Uploading CAPTCHA 4WP as a zip file in WordPress
CAPTCHA 4WP in the WordPress plugin repository
Close

Installing CAPTCHA 4WP Free

Well done you. You're one step closer to safeguarding your WordPress website from spam and automated attacks with CAPTCHA 4WP. You'll be able to effortlessly integrate CAPTCHA into your forms and enjoy a website with enhanced security.

 

Below are two ways to install CAPTCHA 4WP on your website:

Go to your plugin dashboard on your site, then go to "Add New", and then search for CAPTCHA 4WP.

Download the CAPTCHA 4WP plugin zip, then select upload in your plugin dashboard under "Add New".

OPTION 1

OPTION 2

Uploading WP Activity Log as a zip file in WordPress
WP Activity Log in the WordPress plugin repository
Close

Installing WP Activity Log Free on your website

You deserve a pat on the back for choosing to record user actions and changes on your website. That is the first step towards better user accountability, easier troubleshooting of website security, and many other benefits of issues.

 

Below are the two ways to install WP Activity Log on your website:

Go to your plugin dashboard on your site, then go to "Add New" and then search for WP Activity Log.

Download the WP Activity Log plugin zip, then select upload in your plugin dashboard under "Add New".

OPTION 1

OPTION 2

Uploading Melapress Login Security as a zip file in WordPress
Melapress Login Security in the WordPress plugin repository
Close

Installing Melapress Login Security Free

Congratulations on taking control of your WordPress website's security by implementing robust login and password policies with Melapress Login Security. You can change your login page URL, limit failed login attempts, and reset passwords.

 

Below are two ways to install Melapress Login Security on your website:

Go to your plugin dashboard on your site, then go to "Add New" and then search for Melapress Login Security.

Download the Melapress Login Security plugin zip, then select upload in your plugin dashboard under "Add New".

OPTION 1

OPTION 2