• Resolved websgt

    (@websgt)


    I recently installed your suite of plugins (AIOS, Updraft Backup/Restore, WP-Optimize, Internal Link Juicer and Burst Statistics).

    In the IP Detection Settings I have 2 options (and I have tried them both). Any form that I submit via the site has the submitter’s IP address I received from my site. No matter which setting I use, they both now report the IP address my host. I used Bluehost, and I do have Cloudflare, which I have no control over except turning it on/off via the Cpanel.

    I have been digging into this because SITE HEALTH reports this error:
    Unable to detect page cache due to possible loopback request problem. Please verify that the loopback request test is passing. Error: Forbidden (Code: http_403).

    I have been trying to resolve 1 issue but stumbled upon this issue.
    I currently have the firewall and security features disabled.

    Here is the debug info from our app.

    This is from your Debug screen:


    All-In-One Security diagnostics report

    ===================================

    --- AIOS plugin information ---

    AIOS plugin version - 5.4.7
    AIOS DB version - 2.1.4
    AIOS firewall version - 1.0.10
    AIOS Premium installed - No

    ===================================

    --- Server information ---

    Operating system - Linux 5.14.0-162.23.1.9991722448259.nf.el9.x86_64
    Server - Apache
    Memory usage - 20 MB
    Total space - 73.3 GB
    Used space - 21.1 GB

    ===================================

    --- WordPress information ---

    WordPress version - 7.0
    Multisite - No
    ABSPATH - /home2/alnxwgmy/public_html/mclwestchester/
    WP_DEBUG - Off
    WP_DEBUG_LOG - Disabled
    WP_DEBUG_DISPLAY - Enabled
    SCRIPT_DEBUG - Off
    SAVEQUERIES - Off
    DB_CHARSET - utf8
    DB_COLLATE -
    WP_SITEURL - (not set)
    WP_HOME - (not set)
    WP_CONTENT_DIR - /home2/alnxwgmy/public_html/mclwestchester/wp-content
    WP_CONTENT_URL - https://www.mclwestchester.org/wp-content
    WP_PLUGIN_DIR - /home2/alnxwgmy/public_html/mclwestchester/wp-content/plugins
    WP_LANG_DIR - /home2/alnxwgmy/public_html/mclwestchester/wp-content/languages
    WPLANG - (not set)
    UPLOADS - (not set)
    TEMPLATEPATH - /home2/alnxwgmy/public_html/mclwestchester/wp-content/themes/freshwp-pro
    STYLESHEETPATH - /home2/alnxwgmy/public_html/mclwestchester/wp-content/themes/freshwp-pro
    AUTOSAVE_INTERVAL - 300
    WP_POST_REVISIONS - 5
    COOKIE_DOMAIN -
    COOKIEPATH - /
    SITECOOKIEPATH - /
    ADMIN_COOKIE_PATH - /wp-admin
    PLUGINS_COOKIE_PATH - /wp-content/plugins
    NOBLOGREDIRECT - (not set)
    CONCATENATE_SCRIPTS - No
    WP_MEMORY_LIMIT - 40M
    WP_MAX_MEMORY_LIMIT - 512M
    WP_CACHE - Disabled
    CUSTOM_USER_TABLE - (not set)
    CUSTOM_USER_META_TABLE - (not set)
    FS_CHMOD_DIR - 493
    FS_CHMOD_FILE - 420
    ALTERNATE_WP_CRON - Disabled
    DISABLE_WP_CRON - Cron is disabled
    WP_CRON_LOCK_TIMEOUT - 120
    EMPTY_TRASH_DAYS - 7
    WP_ALLOW_REPAIR - Disabled
    DO_NOT_UPGRADE_GLOBAL_TABLES - No
    DISALLOW_FILE_EDIT - No
    DISALLOW_FILE_MODS - No
    IMAGE_EDIT_OVERWRITE - No
    FORCE_SSL_ADMIN - Yes
    WP_HTTP_BLOCK_EXTERNAL - No
    WP_ACCESSIBLE_HOSTS - (not set)
    WP_AUTO_UPDATE_CORE - Default
    WP_PROXY_HOST - (not set)
    WP_PROXY_PORT - (not set)
    MULTISITE - No
    WP_ALLOW_MULTISITE - No
    SUNRISE - No
    SUBDOMAIN_INSTALL - No
    VHOST - No
    DOMAIN_CURRENT_SITE - (not set)
    PATH_CURRENT_SITE - (not set)
    BLOG_ID_CURRENT_SITE - (not set)
    WP_DISABLE_FATAL_ERROR_HANDLER - No
    AUTOMATIC_UPDATER_DISABLED - No

    ===================================

    --- PHP information ---

    PHP version - 8.5.6
    PHP expose php - Inactive
    PHP allow url fopen - Active
    PHP memory limit - 512M
    PHP upload max filesize - 512M
    PHP post max size - 516M
    PHP max execution time - 60
    PHP max input time - 60
    Process owner - alnxwgmy
    OpenSSL support - OK
    OpenSSL version - OpenSSL 3.0.7 1 Nov 2022
    cURL support - OK
    cURL features code - 29345693
    cURL host - x86_64-redhat-linux-gnu
    cURL support protocols - dict, file, ftp, ftps, gopher, gophers, http, https, imap, imaps, ldap, ldaps, mqtt, pop3, pop3s, rtsp, scp, sftp, smb, smbs, smtp, smtps, telnet, tftp
    cURL SSL version - OpenSSL/3.5.1
    cURL libz version - 1.2.11
    Checking display_errors - Disabled

    ===================================

    --- Database information ---

    Database version - 5.7.44
    DELETE - OK
    INSERT - OK
    UPDATE - OK
    SELECT - OK
    CREATE TABLE - OK
    ALTER TABLE - OK
    DROP - OK
    TRUNCATE - OK

    ===================================

    --- Plugin information ---

    All-In-One Security (AIOS) (wp-security) [5.4.7] - Active
    BasePress (basepress) [2.17.0.2] - Active
    Branda (ultimate-branding) [3.4.29] - Active
    Burst Statistics - Privacy-Friendly Analytics for WordPress (burst) [3.4.3] - Active
    Code Manager (code-manager) [1.0.46] - Active
    E2Pdf (e2pdf) [1.32.18] - Active
    Easy Media Gallery Pro (easy-media-gallery-pro) [1.6.0.43] - Active
    Forminator (forminator) [1.53.2] - Active
    Gutentor - Gutenberg Blocks - Page Builder for Gutenberg Editor (gutentor) [3.5.6] - Active
    Health Check & Troubleshooting (health-check) [1.7.1] - Active
    ImageMagick Engine (imagemagick-engine) [1.8.0] - Active
    Internal Link Juicer (wp-internal-linkjuicer) [2.26.0] - Active
    Link Library (link-library) [7.9.2] - Active
    Menu In Post (menu-in-post) [1.5.0] - Active
    My Calendar - Accessible Event Manager (my-calendar) [3.7.13] - Active
    PublishPress Capabilities Pro (capabilities-pro) [2.43.0] - Active
    Quotes llama (class-quotesllama) [3.1.1] - Active
    Simple File List Access (ee-simple-file-list-access) [3.1.2] - Active
    Simple File List Email (ee-simple-file-list-email) [1.2.2] - Active
    Simple File List Pro (ee-simple-file-list-pro) [6.1.12] - Active
    Simple File List Search (ee-simple-file-list-search) [3.1.2] - Active
    TablePress (tablepress) [3.3.1] - Active
    The Bluehost Plugin (bluehost-wordpress-plugin) [4.16.1] - Inactive
    UpdraftPlus - Backup/Restore (updraftplus) [1.26.4] - Active
    WP-Optimize - Clean, Compress, Cache (wp-optimize) [4.5.3] - Active
    WP-PageNavi (wp-pagenavi) [2.94.5] - Active
    WPCode Lite (ihaf) [2.3.5] - Active
    WP Crontrol (wp-crontrol) [1.21.0] - Active
    WP Go Maps (formerly WP Google Maps) (wpgooglemaps) [10.0.10] - Active
    WP Go Maps - Pro Add-on (wp-google-maps-pro) [9.0.36] - Active
    WP Rollback (wp-rollback) [3.1.2] - Active

    ===================================

    --- Must-use plugin information ---

    Burst REST API Optimizer (burst_rest_api_optimizer) [1.0.0] - Active
    Endurance Page Cache (endurance-page-cache) [2.2.2] - Active
    Health Check Troubleshooting Mode (health-check-troubleshooting-mode) [1.7.2] - Active
    simba-tfa-encryption-key.php (simba-tfa-encryption-key) [] - Active
    SSO (sso) [0.4] - Active

    ===================================

    --- Drop-in information ---

    advanced-cache.php [Advanced caching plugin.] - Inactive
    db.php [Custom database class.] - Active
    db-error.php [Custom database error message.] - Active
    install.php [Custom installation script.] - Active
    maintenance.php [Custom maintenance message.] - Active
    object-cache.php [External object cache.] - Active
    php-error.php [Custom PHP error message.] - Active
    fatal-error-handler.php [Custom PHP fatal error handler.] - Active

    ===================================

    --- Theme information ---

    FreshWP PRO (freshwp-pro) [1.0.2] - Active
    Twenty Twenty-Five (twentytwentyfive) [1.5] - Inactive

    ===================================

    --- IP detection methods ---

    REMOTE_ADDR - IP: 71.183.235.10 - status: On
    HTTP_CF_CONNECTING_IP - IP: 71.183.235.10
    HTTP_X_FORWARDED_FOR - IP:
    HTTP_X_FORWARDED - IP:
    HTTP_CLIENT_IP - IP:
    HTTP_X_REAL_IP - IP:
    HTTP_X_CLUSTER_CLIENT_IP - IP:

    ===================================

    --- Cron information ---

    Failed cron jobs - 0
    action_scheduler_run_queue -
    cf7pp_payment_check_status - hourly
    mojo_cron_hourly - hourly
    wp_privacy_delete_old_export_files - hourly
    epc_scheduled_purge_all -
    wp_update_plugins - twicedaily
    wp_update_themes - twicedaily
    mojo_cron_twicedaily - twicedaily
    wp_version_check - twicedaily
    gutentor_daily_scheduled_events - daily
    wp_update_user_counts - twicedaily
    fs_data_sync_wp-data-access - daily
    recovery_mode_clean_expired_keys - daily
    wp_scheduled_delete - daily
    delete_expired_transients - daily
    wp_scheduled_auto_draft_delete - daily
    tribe_common_log_cleanup - daily
    tribe_daily_cron - daily
    wsm_dailyScheduler - daily
    schedule_report_event - daily
    schedule_daily_report - daily
    mojo_cron_daily - daily
    fs_data_sync_basepress - daily
    mojo_cron_weekly - weekly
    wp_delete_temp_updater_backups - weekly
    wpcode_usage_tracking_cron - weekly
    wp_site_health_scheduled_check - weekly
    bh_data_cron - weekly
    gutentor_weekly_scheduled_events - weekly
    aiowps_weekly_cron_event - weekly
    aiowps_clean_old_events - daily
    burst_every_ten_minutes - burst_every_ten_minutes
    burst_monthly - burst_monthly
    process_smush_tasks -
    upgrader_scheduled_cleanup -
    prune_smush_logs -
    burst_clear_test_visit -
    wpo_webp_convert_compressed_images - daily
    updraftplus_clean_temporary_files - twicedaily
    puc_cron_check_updates-ee-simple-file-list-pro - twicedaily
    puc_cron_check_updates-ee-simple-file-list-access - twicedaily
    wpo_weekly_cron_tasks - wpo_weekly
    puc_cron_check_updates-ee-simple-file-list-search - twicedaily
    puc_cron_check_updates-ee-simple-file-list-email - twicedaily
    burst_every_hour - burst_every_hour
    burst_daily - burst_daily
    burst_weekly - burst_weekly
    fs_install_sync_code-manager -
    fs_install_sync_internal-links -
    e2pdf_cache_tmp_cron - daily
    wpo_reset_webp_conversion_test_result - wpo_daily
    wpo_prune_webp_logs - weekly
    wpo_prune_404_log - wpo_daily
    wpo_smush_clear_backup_images - daily
    wpo_smush_clear_failed_tasks - wpo_monthly
    emg_cron_event - oneday
    nfd_data_sync_cron - minutely
    aios_15_minutes_cron_event - aios-every-15-minutes
    aiowps_hourly_cron_event - hourly
    aiowps_daily_cron_event - daily
    nfd_htaccess_daily_scan - daily
    fs_data_sync_internal-links - daily
    fs_data_sync_code-manager - daily
    wpo_minify_purge_old_cache - daily
    nfd_data_cron - weekly
    wpo_reset_stats_counter -
    mojo_cron_monthly - monthly

    ===================================

    Thank you in Advance for your assistance in this matter.

    Regards,
    Steve

    The page I need help with: [log in to see the link]

Viewing 2 replies - 1 through 2 (of 2 total)
  • Plugin Support hjogiupdraftplus

    (@hjogiupdraftplus)

    Hi @websgt,

    From the debug log, it appears that the IP address 71.183.235.10 is being detected, and REMOTE_ADDR from the server information is being used for IP detection. This matches the HTTP_CF_CONNECTING_IP value generally provided by Cloudflare.

    REMOTE_ADDR - IP: 71.183.235.10 - status: On
    HTTP_CF_CONNECTING_IP - IP: 71.183.235.10

    If the detected IP address does not match the address shown on https://whatismyipaddress.com/, the server may be behind a proxy or may not be configured properly. It needs to make sure that the server IP address is not detected as the visitor IP address; otherwise, it may block the server IP address and show a 403 forbidden error.

    Regards

    Steve, a couple of things stand out in your debug that should narrow this down.

    IP detection is actually working in your case. Your report shows:

    REMOTE_ADDR            - IP: 71.183.235.10
    HTTP_CF_CONNECTING_IP  - IP: 71.183.235.10

    Both resolve to the same address, and that’s your real client IP – so AIOS is already seeing the visitor, not your host. On a Bluehost + Cloudflare cPanel box Apache often doesn’t restore the client IP, but here it clearly is (Bluehost sets it at the server level), so you can leave IP Detection on REMOTE_ADDR. Switching to CF-Connecting-IP would only matter if REMOTE_ADDR were showing a Cloudflare 104.x/172.x address – which it isn’t.

    One caveat worth knowing: only trust CF-Connecting-IP when the request actually comes from a Cloudflare IP range. If a plugin forces it unconditionally, someone bypassing the proxy can spoof their IP by sending that header directly – which would let them dodge lockouts.

    Your real symptom is separate from IP detection. “Unable to detect page cache… loopback request… Forbidden (403)” is a loopback issue: your server calls its own URL (https://www.mclwestchester.org/...), that request leaves the box, hits Cloudflare, and comes back – and Cloudflare (or Bluehost’s Endurance Page Cache / a security rule) answers 403 to that server-to-self call. Common fixes:

    • Keep loopback local: point your domain to 127.0.0.1 in the server hosts file so the loopback never leaves the box (often not possible on shared Bluehost).
    • In Cloudflare, make sure your own origin IP isn’t being challenged/blocked, and that WP-Cron/loopback paths aren’t cached or filtered.

    So: IP detection is fine to leave as-is; chase the 403 loopback separately – that’s what’s actually failing Site Health.

Viewing 2 replies - 1 through 2 (of 2 total)

You must be logged in to reply to this topic.