Wordfence "How does Wordfence get IPs' setting is misconfigured" behind cloudflare

Hello everyone,

i have a questions about wordfence with cloudflare. I have my website behind a cloudflare proxy and i am using wordfence on that site. As said by the docs, i have set wordfence to get IPs with the following setting: “CF-Connecting-IP HTTP header” which is the correct one, isn’t it? Still wordfence is giving me the following message every time i log into my admin area:

" **Your 'How does Wordfence get IPs' setting is misconfigured.** This site is currently using the Cloudflare "CF-Connecting-IP" HTTP header, which should only be used when the site is behind Cloudflare. This site appears to be behind a front-end proxy, so using the X-Real-IP HTTP header will resolve to the correct IPs. [Click here to use the recommended setting](https://buergerhaus-mausbach.de/wp-admin/#) or [visit the options page](https://buergerhaus-mausbach.de/wp-admin/admin.php?page=Wordfence&subpage=global_options) to manually update it."

I am definitely behind a cloudflare proxy, as i get the normal anti ddos check when going onto the site and have the cloudflare universal SSL certificate on that site when connected.
So i do not understand why i get that message from wordfence, can anybody help me with that issue?

Thanks for the help in advance.
Cheers, Mats

EDIT: The IP wordfence shows me as an example of which ip it is getting is my ip address, so wordfence is getting the correct IPs using that setting, but i do not understand why it is still showing me the issue message on multiple sites.

That’s a good question. It sounds like that setting is correct, but thinks it’s wrong. Is showing IPv4 or IPv6?

I just checked mine and it’s returning my home IPv4 address and Wordfence isn’t complaining about it. Oddly enough, as I started picking different options, it switched over to my IPv6 address, even going back to my original CF setting.

Cloudflare also uses the x-forwarded-for header, so you can try that one and see if you still get that warning.

Switching over to Tools → Diagnostics, I expanded all sections and saw IP Detection is correct, except for X-Real-IP, which is blank.

hey, thanks for the answer.

It is showing me my correct IPv6 home address on both settings and it is still showing me the error with the x-forwarded-for header setting. But everything seems to be working fine, as it is detecting the correct address, just getting that error message everytime i go into my dashboard is pretty annoying.

1 Like

I know Wordfence is active in the Wordpress Plugins forum, so they might know why that’s happening.

Yeah, i’ll try to post the issue over there. Thanks for trying to help tho.

1 Like

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.