Title: Not working
Last modified: August 30, 2016

---

# Not working

 *  Resolved [iworldc](https://wordpress.org/support/users/iworldc/)
 * (@iworldc)
 * [10 years, 10 months ago](https://wordpress.org/support/topic/not-working-1430/)
 * Illegal login attempts (admin, administrator) are ALL coming from IP 127.0.0.1.
   thus the IP can’t and won’t be blocked.
 * The count of illegal login attempts is rising every day.
 * How can we fix this?
 * [https://wordpress.org/plugins/sucuri-scanner/](https://wordpress.org/plugins/sucuri-scanner/)

Viewing 3 replies - 1 through 3 (of 3 total)

 *  [yorman](https://wordpress.org/support/users/yorman/)
 * (@yorman)
 * [10 years, 9 months ago](https://wordpress.org/support/topic/not-working-1430/#post-6634610)
 * Fixing this requires to have more information about the environment where you
   encountered this issue as the current code works for every other website. You
   are part of a small group of people that have reported this issue in the past
   and it was always product of a misconfiguration of the server where the website
   is/was being hosted or with an additional extension that was overriding the value
   of the global server variable _REMOTE\_ADDR_.
 * People with the reverse proxy option enabled were also experiencing this issue
   as their websites were not behind a proxy nor a firewall so the IP address was
   being reverted to one of the loopbacks.
 * I will mark this as resolved _(per the explanation above)_ we can reopen the 
   ticket once you provide the information that I need to reproduce the issue in
   my own server as that is the only way I can investigate and possibly fix the 
   problem.
 *  Thread Starter [iworldc](https://wordpress.org/support/users/iworldc/)
 * (@iworldc)
 * [10 years, 9 months ago](https://wordpress.org/support/topic/not-working-1430/#post-6634611)
 * The _REMOTE\_ADDR_ server variable will work when they’re NOT using a reverse
   proxy. This is the majority of all WordPress users. But 100% relying on this 
   server variable is not good, because in cases where they do use a reverse proxy,
   the value of this variable becomes unreliable.
 * Why not check for the _HTTP\_X\_FORWARDED\_FOR_ server variable FIRST?
 * If it’s there, you use that IP. If it’s not there, use the REMOTE_ADDR server
   variable.
 * This makes your user IP retrieving mechanism more reliable in cases where they
   use a reverse proxy like cloudflare.
 *  [yorman](https://wordpress.org/support/users/yorman/)
 * (@yorman)
 * [10 years, 9 months ago](https://wordpress.org/support/topic/not-working-1430/#post-6634612)
 * Yes, that is an option too, to check _X-Forwarded-For_ first; the thing is, every
   header prefixed with _“HTTP”_ can be easily spoofed, so if I change the code 
   to accept _X-Forwarded-For_ first it will allow malicious users to send arbitrary
   IP addresses to hide the real origin of the request.
 *     ```
       curl -H "X-Forwarded-For: 31.13.74.1" "http://example.com/"
       ```
   
 * The previous command will force the plugin to log that IP address _(which at 
   the time is associated to Facebook’s network)_ instead of his/her real IP; during
   an audit you would start asking why someone from Facebook would be attacking 
   your website.
 * The custom headers used by CloudFlare and Sucuri and many other firewalls can
   be trusted only when the owner of the site explicitly enables the reverse proxy
   option because if the website is indeed behind a firewall then the IP address
   is surely in that header, otherwise it is unsafe; this option is opt-in and not
   opt-out to protect the majority of users.

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘Not working’ is closed to new replies.

 * ![](https://ps.w.org/sucuri-scanner/assets/icon-256x256.png?rev=2875755)
 * [Sucuri Security - Auditing, Malware Scanner and Security Hardening](https://wordpress.org/plugins/sucuri-scanner/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/sucuri-scanner/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/sucuri-scanner/)
 * [Active Topics](https://wordpress.org/support/plugin/sucuri-scanner/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/sucuri-scanner/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/sucuri-scanner/reviews/)

## Tags

 * [block IP](https://wordpress.org/support/topic-tag/block-ip/)
 * [login](https://wordpress.org/support/topic-tag/login/)

 * 3 replies
 * 2 participants
 * Last reply from: [yorman](https://wordpress.org/support/users/yorman/)
 * Last activity: [10 years, 9 months ago](https://wordpress.org/support/topic/not-working-1430/#post-6634612)
 * Status: resolved