Guides & TutorialsTroubleshooting AdvancedTroubleshooting Server IP Address Appearing in Client Logs

Troubleshooting Server IP Address Appearing in Client Logs

Symptoms

When viewing the activity logs kept by WHMCS, the final column indicates the IP address of the person taking the action. This is typically the client or member of staff:

  • Utilities > Logs > Activity Log
  • Utilities > Logs > Admin Log
  • Utilities > Logs > Whois Log

If you are seeing the server IP address recorded in the IP Address column instead, this is because the IP address being supplied to PHP by the server configuration is not that of the visitor performing the action on the web-page.

Explanation

WHMCS checks the following variables in descending order for an IP address. If the IP is available and not a local address, it will use that as the client's IP address on the order form, details, and logs. If none of these are available, WHMCS will return the REMOTE_ADDR as the IP. This applies to both IPv4 and IPv6 connections.

  • HTTP_CLIENT_IP
  • HTTP_X_FORWARDED_FOR
  • HTTP_X_FORWARDED
  • HTTP_X_CLUSTER_CLIENT_IP
  • HTTP_FORWARDED_FOR
  • HTTP_FORWARDED
  • REMOTE_ADDR

Therefore if one of these PHP variables is reporting the server's IP address instead of the visitor's IP address, that will be recorded by WHMCS.

This situation most often arises when used in conjunction with a proxy or forwardering service (such as Cloudflare).

Resolution

To resolve this situation, it is necessary to configure WHMCS to recognize the proxy server's details via the Trusted Proxy settings.

1. Navigate to Setup > General Settings

2. Select the Security tab

3. Complete the Proxy IP Header and Trusted Proxies fields per your proxy server's configuration.

4. Click Save Changes

 Once properly configured, the IP address logged will then correctly reflect that of the admin or client performing an action.

More in-depth discussion of these options and their usage are published at: