Understanding Visitor IP Address Detection
Identifying visitors and distinguishing them from each other is core to any security service. Shield uses the visitor IP address to identify visitors.
It is critical that the plugin can detect the visitor IP address accurately and so the option to select the visitor IP address source is perhaps one of the most important configuration options.
Unfortunately, visitor IP address detection can be unreliable for many web hosts. Every webhost differs at least a little in their configuration, and sometimes they're not configured as well as they should be.
To help with this, we provide a simple way for you to direct Shield on where to find the correct visitor IP address. Shield will try to do all of this automatically, but where this fails, we'll need your help.
This option is accessible from within the main sidebar menu > Configure > General > General Plugin Configuration > IP Source.
There are a list of technical looking IP address sources. We will need you to pick the one that is correct.
If you don't know what your particular IP address is, please see here:
https://getshieldsecurity.com/my-ip/
Use the IP address printed on that page to select the source from the dropdown that is giving the same IP.
This will help ensure Shield is using the correct source for visitor IP addresses.
Important: Sites behind a proxy or firewall service
If your site runs behind a service such as Cloudflare or the Sucuri Website Firewall, visitor requests reach your site through that service’s servers. In that case, REMOTE_ADDR usually shows the service’s IP address, not your visitor’s. Shield then treats many different visitors as the same visitor, and real visitors can end up blocked.
Select the source that holds the real visitor IP instead:
- Cloudflare: HTTP_CF_CONNECTING_IP
- Sucuri Website Firewall: HTTP_X_SUCURI_CLIENTIP
Check that the IP in brackets matches the IP on https://getshieldsecurity.com/my-ip/
If REMOTE_ADDR already shows your own IP, your host restores the real visitor IP, and you can keep REMOTE_ADDR.
Note: The IP Source dropdown only lists sources where Shield currently detects an IP. If you don’t see the source for your service, the header isn’t reaching your site. Please ask your host to check this.
Apart from General Plugin Configuration settings, you can use an option for checking visitor IP source (under the Debug Info Page) and Shield will try to detect visitor IP addresses more accurately, for your particular web hosting.
Note: If you can't change the IP source, please read the article here.