logged IP address is of server, not client

[rdzman]

I’m shopping around for a download manager/monitor plugin and in testing Simple Download Monitor, it appears that the IP address being logged is that of my server, not of the client doing the downloading. I’ve noticed this with several other (but not all) plugins I’ve tested. E.g. https://wordpress.org/plugins/delightful-downloads/ logs the server IP, just like Simple Download Monitor, but https://wordpress.org/plugins/download-monitor/ seems to be able to capture the client IP just fine.

Any ideas why this is happening?

[admin]

Are you using cloudflare on this site? What kind of hosting are you using?

[rdzman]

This is a HostGator Shared / Hatchling account. I’m not familiar with CloudFlare, but I’m pretty sure I’m not using it. It’s a pretty vanilla HostGator WordPress setup.

[rdzman]

A little poking around in the code in sdm_get_ip_address() reveals that on my site it’s picking up the IP address from HTTP_X_FORWARDED_FOR, which contains the IP address of the server, rather than REMOTE_ADDR, which contains the correct IP address of the client.

I noticed that Download Monitor includes an explicit option to “Allow Proxy IP Override” with the help text “If enabled, Download Monitor will use the X_FORWARDED_FOR HTTP header set by proxies as the IP address. Note that anyone can set this header, making it less secure.”

Any chance you could make this optional in Simple Download Monitor as well? Unfortunately, without something like that, SDM isn’t an option for me.

[Author]

Posts