Troubleshooting Server IP Address Appearing in Client Logs
When viewing the activity logs kept by WHMCS, the final column indicates the IP address of the person taking the action. This is typically the client or member of staff:
- Utilities > Logs > Activity Log
- Utilities > Logs > Admin Log
- Utilities > Logs > Whois Log
If you are seeing the server IP address recorded in the IP Address column instead, this is because the IP address being supplied to PHP by the server configuration is not that of the visitor performing the action on the web-page.
WHMCS checks the following variables in descending order for an IP address. If the IP is available and not a local address, it will use that as the client's IP address on the order form, details, and logs. If none of these are available, WHMCS will return the REMOTE_ADDR as the IP. This applies to both IPv4 and IPv6 connections.
Therefore if one of these PHP variables is reporting the server's IP address instead of the visitor's IP address, that will be recorded by WHMCS.
This situation most often arises when used in conjunction with a proxy or forwardering service (such as Cloudflare).
To resolve this situation, it is necessary to configure WHMCS to recognize the proxy server's details via the Trusted Proxy settings.
1. Navigate to Setup > General Settings
2. Select the Security tab
3. Complete the Proxy IP Header and Trusted Proxies fields per your proxy server's configuration.
4. Click Save Changes
Once properly configured, the IP address logged will then correctly reflect that of the admin or client performing an action.
More in-depth discussion of these options and their usage are published at: