Wordfence Live Traffic reports same IP for all entries

  • Resolved bizdevweb

    (@bizdevweb)


    6 years ago

    I have multiple wordpress based websites that are reporting the same ip address for all visitors in wordfence live traffic. On the diagnostics page it identifies my IP address correctly and the host ip for my sites.

    I have tried the two IP Identity options:
    Let Wordfence use the most secure method to get visitor IP addresses. Prevents spoofing and works with most sites. (Recommended)
    Use PHP’s built in REMOTE_ADDR and don’t use anything else. Very secure if this is compatible with your site.
    They both identify my ip correctly but don’t work in Live Traffic screen.

    At this point I have no way to block bad bots and others hitting my sites.

    Suggestions???

Viewing 5 replies - 1 through 5 (of 5 total)
  • wfdave

    (@wfdave)

    Hi @bizdevweb,

    Can you try using Use the Cloudflare “CF-Connecting-IP” HTTP header to get a visitor IP?

    Thanks!

    Dave

    Thread Starter bizdevweb

    (@bizdevweb)

    I’ve tried all of the different options but none of them show the actual visitor IP. I checked on some of my other sites that are on the same bluehost hosting account and WF live traffic works fine on all of them except the primary domain/website. This is true for two different hosting accounts I operate.

    Very strange have been using WF for years & issue never came up until 11/10/18.

    I have a feeling that Wordfence is failing to utilize CF-Connecting-IP properly.

    Can I have you reinstall Wordfence (exporting/importing settings as needed) and seeing if the IPs are still the same in live traffic?

    Thanks!

    Dave

    Thread Starter bizdevweb

    (@bizdevweb)

    I tried a complete removal (files & MySQL Tables) & fresh install from scratch and it still mis-reports the IP’s. I also re-installed wordpress from scratch and added my content back in.

    It’s doesn’t make sense to me. I would think all websites on the same hosting account would be the same setup???

    I have the first IP option set for two sites on the very same hosting account.
    Let Wordfence use the most secure method to get visitor IP addresses. Prevents spoofing and works with most sites. (Recommended)

    It detects my client IP on the config page properly for both sites.
    Detected IP(s): 47.151.XXX.XX
    Your IP with this setting: 47.151.XXX.XX

    BUT, live traffic is invalid on one site and valid on the other.

    Something about the way wordfence is reading the Header info is off. I figured out the IP that is reporting all traffic from is the X-Real-Ip: IP Address. This only seems to happen on a few of my sites and all others don’t show a X-Real-Ip: value when I check them with a PHP script.

    From the wordfence diagnostics tab I noticed that the sites that work don’t show any values for
    Working sites show
    REMOTE_ADDR 47.151.XXX.XX In use
    CF-Connecting-IP (not set)
    X-Real-IP (not set)
    X-Forwarded-For (not set)

    Invalid sites show
    REMOTE_ADDR 47.151.XXX.XX In use
    CF-Connecting-IP (not set)
    X-Real-IP 47.151.XXX.XX
    X-Forwarded-For 162.241.XXX.XX

    Thread Starter bizdevweb

    (@bizdevweb)

    Not sure if the latest update or the hosting provider made changes, but the problem is magically fixed on my sites. They are all now properly reporting the visitor IP addresses.

Viewing 5 replies - 1 through 5 (of 5 total)
  • The topic ‘Wordfence Live Traffic reports same IP for all entries’ is closed to new replies.