Wrong IPs being displayed in the reports

Can you check if it is the IP of the web server? ARe other IPs in live traffic unique or are they the same?

tim

I am having a similar problem. The IP and location displayed are not of the user, but of the web server.

I have noticed that the ip/location are of the server when users log in from our /login page but are correct if they login from the /wp-login.php page.

Everything worked fine before a recent server migration. Since then I have completely erased and reinstalled Wordfence but am still getting the same issue. Any ideas?

Cycle through the options for “How Wordfence gets its IPs”. Check live traffic after each selection to see if you are seeing correct IP addresses.

tim

Hi! Sorry for taking this long to answer, had some issues in the site that needed fixing before this one.

I’m pasting what I’ve sent to Incapsula below, as it helps here; from what I got, looks like they’re the ones handling this IP part through Sitelock’s firewall or something of the sorts.

“I have a website that has Wordfence installed. I always get a notification everytime somebody with admin privilegies enters my site, including myself. Before activating Sitelock’s firewall, I used to get these notifications accusing exactly the place from where the access came from. Now, Wordfence is always accusing the accesses as being made from Incapsula’s IP addresses, even when I enter the site (and I live in Brazil, not in Dover, USA). Below are these addresses:

User IP: 198.143.39.97
User hostname: 198.143.39.97.ip.incapdns.net
User location: Dover, United States

User IP: 198.143.41.1
User hostname: 198.143.41.1.ip.incapdns.net
User location: United States

User IP: 198.143.57.65
User hostname: 198.143.57.65.ip.incapdns.net
User location: Dover, United States

So, any way to get Wordfence to accuse the right IP addresses again?”

Any ideas on what might be happening here?

Thanks. ??

Did you try this solution?

Cycle through the options for “How Wordfence gets its IPs”. Check live traffic after each selection to see if you are seeing correct IP addresses.

tim

The only option I see that looks like that says “How does Wordfence get IPs:” and beside it there’s a dropdown menu to choose from, but nothing that mentions live traffic; is it because I’m using the free version of the plugin?

You cycle through the options in the drop down menu, saving after each one, then try viewing in live traffic to see if the IPs are unique and not all the same as the servers.

tim

The only one that restablished the IP detection was the third option: “Use the X-Forwarded-For HTTP header. Only use if you have a front-end proxy or spoofing may result.”. So, I just leave it like that? Can’t it cause me any issues?

Thanks.

Yes, you can keep that option selected — if that is the only one giving the correct IP address, then that is the safest to use with your host. The only reason you would need to change it to something else again, is if your host changes their setup.