Wordfence "How does Wordfence get IPs' setting is misconfigured" behind cloudflare

General
1

Hello everyone,

i have a questions about wordfence with cloudflare. I have my website behind a cloudflare proxy and i am using wordfence on that site. As said by the docs, i have set wordfence to get IPs with the following setting: “CF-Connecting-IP HTTP header” which is the correct one, isn’t it? Still wordfence is giving me the following message every time i log into my admin area:

" **Your 'How does Wordfence get IPs' setting is misconfigured.** This site is currently using the Cloudflare "CF-Connecting-IP" HTTP header, which should only be used when the site is behind Cloudflare. This site appears to be behind a front-end proxy, so using the X-Real-IP HTTP header will resolve to the correct IPs. [Click here to use the recommended setting](https://buergerhaus-mausbach.de/wp-admin/#) or [visit the options page](https://buergerhaus-mausbach.de/wp-admin/admin.php?page=Wordfence&subpage=global_options) to manually update it."

I am definitely behind a cloudflare proxy, as i get the normal anti ddos check when going onto the site and have the cloudflare universal SSL certificate on that site when connected.
So i do not understand why i get that message from wordfence, can anybody help me with that issue?

Thanks for the help in advance.
Cheers, Mats

EDIT: The IP wordfence shows me as an example of which ip it is getting is my ip address, so wordfence is getting the correct IPs using that setting, but i do not understand why it is still showing me the issue message on multiple sites.

2

That’s a good question. It sounds like that setting is correct, but thinks it’s wrong. Is showing IPv4 or IPv6?

I just checked mine and it’s returning my home IPv4 address and Wordfence isn’t complaining about it. Oddly enough, as I started picking different options, it switched over to my IPv6 address, even going back to my original CF setting.

Cloudflare also uses the x-forwarded-for header, so you can try that one and see if you still get that warning.

Switching over to Tools → Diagnostics, I expanded all sections and saw IP Detection is correct, except for X-Real-IP, which is blank.

3

hey, thanks for the answer.

It is showing me my correct IPv6 home address on both settings and it is still showing me the error with the x-forwarded-for header setting. But everything seems to be working fine, as it is detecting the correct address, just getting that error message everytime i go into my dashboard is pretty annoying.

1 Like
4

I know Wordfence is active in the Wordpress Plugins forum, so they might know why that’s happening.

5

Yeah, i’ll try to post the issue over there. Thanks for trying to help tho.

1 Like
6

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.