Title: Log real IP
Last modified: August 20, 2016

---

# Log real IP

 *  Resolved [Dr.Bier](https://wordpress.org/support/users/drbier/)
 * (@drbier)
 * [13 years, 6 months ago](https://wordpress.org/support/topic/log-real-ip/)
 * Hi,
 * Here is a small code change to log real-ip instead of 127.0.0.1. You need to 
   set X-Real-IP header in your web-server when proxying. Change line 424 to:
 * ‘ip’ => isset($_SERVER[‘HTTP_X_REAL_IP’])?$_SERVER[‘HTTP_X_REAL_IP’]:$_SERVER[‘
   REMOTE_ADDR’],
 * Best regards,
    Alexander
 * [http://wordpress.org/extend/plugins/simple-login-log/](http://wordpress.org/extend/plugins/simple-login-log/)

Viewing 5 replies - 1 through 5 (of 5 total)

 *  Plugin Contributor [Max Chirkov](https://wordpress.org/support/users/maxchirkov/)
 * (@maxchirkov)
 * [13 years, 5 months ago](https://wordpress.org/support/topic/log-real-ip/#post-3384376)
 * Thanks, Alexander! It’s now implemented in version 0.9.5
 *  [Jim](https://wordpress.org/support/users/imagenuity/)
 * (@imagenuity)
 * [13 years, 5 months ago](https://wordpress.org/support/topic/log-real-ip/#post-3384380)
 * Relevant information on the difficulties determining the real IP address.
 * [http://security.stackexchange.com/questions/27958/brute-force-login-attempt-from-spoofed-ips](http://security.stackexchange.com/questions/27958/brute-force-login-attempt-from-spoofed-ips)
 * [http://php.net/manual/en/reserved.variables.php](http://php.net/manual/en/reserved.variables.php)
 * There is a danger of introducing a spoofed IP address vulnerability.
 *  Plugin Contributor [Max Chirkov](https://wordpress.org/support/users/maxchirkov/)
 * (@maxchirkov)
 * [13 years, 5 months ago](https://wordpress.org/support/topic/log-real-ip/#post-3384383)
 * Hi Jim,
 * I’m not a security expert, but in our case we’re simply loggin information – 
   we’re not using any IPs for authentication purposes. With the same success, I
   can simply leave the IP field as it was (REMOTE_ADDR) and add HTTP_X_REAL_IP 
   under the DATA field, together with header information. As far as I know, header
   information together with User-Agent can be spoofed as well, but we don’t really
   worry about that either.
 * Unless I’m missing your point?
 *  [Jim](https://wordpress.org/support/users/imagenuity/)
 * (@imagenuity)
 * [13 years, 5 months ago](https://wordpress.org/support/topic/log-real-ip/#post-3384385)
 * I am no security expert either, and true, this is simply logging information.
   I commented because I found a lot of poor information and bad code examples about
   this topic while searching for more information, and added the comment above 
   to point to relevant information for those that want it. In the case of Simple
   Login Log, this change wouldn’t introduce a vulnerability.
 * Assuming REMOTE_ADDR is not a local IP (such as 127.0.0.1), if HTTP_X_REAL_IP
   and REMOTE_ADDR were different, that would be information of interest to me.
 * Thanks for the work in Login Log, it’s a useful plugin.
 *  Plugin Contributor [Max Chirkov](https://wordpress.org/support/users/maxchirkov/)
 * (@maxchirkov)
 * [13 years, 5 months ago](https://wordpress.org/support/topic/log-real-ip/#post-3384392)
 * Jim,
 * I appreciate your input! I’ve never heard about HTTP_X_REAL_IP before, and I 
   make quite a few security errors in my plugins, due to lack of experience. Thanks
   for the links as well – I have a little better understanding of this now. I made
   a note to myself to log both IPs – I think this would make it more useful.
 * Thanks again and have a great weekend!

Viewing 5 replies - 1 through 5 (of 5 total)

The topic ‘Log real IP’ is closed to new replies.

 * ![](https://ps.w.org/simple-login-log/assets/icon-256x256.png?rev=3487526)
 * [Simple Login Log](https://wordpress.org/plugins/simple-login-log/)
 * [Support Threads](https://wordpress.org/support/plugin/simple-login-log/)
 * [Active Topics](https://wordpress.org/support/plugin/simple-login-log/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/simple-login-log/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/simple-login-log/reviews/)

 * 5 replies
 * 3 participants
 * Last reply from: [Max Chirkov](https://wordpress.org/support/users/maxchirkov/)
 * Last activity: [13 years, 5 months ago](https://wordpress.org/support/topic/log-real-ip/#post-3384392)
 * Status: resolved