Help

Solving problem with incorrect IP address detection

It's a crucial for the plugin to detect all IP addresses correctly.


In some rare cases, WP Cerber is unable to get IP addresses automatically due to hosting limitations or a non-standard server configuration. That means WP Cerber is unable to protect your website the right way and might even lock you out of your WordPress dashboard.

First of all, try to enable My site is behind a reverse proxy in the Main Settings of the plugin and check how the plugin detects IP addresses.

To make sure that Cerber detects IP addresses correctly

  1. Open the What is my IP address page in a browser tab (window) and the Access Lists admin page on your website in another browser tab (window).
  2. Compare the IP address on theĀ What is my IP address page to the IP address under the Your IP label on the Access Lists admin page.
  3. You should see two identical IP addresses.

If you are still unable to make the plugin detect IP addresses correctly, you have to define a special CERBER_IP_KEY constant in the wp-config.php file. The plugin will use it as a key to obtain IP addresses from the $_SERVER variable. See the instruction below.

Please follow these steps

  1. Get your current IP address on the What is my IP address page
  2. Go to the Tools admin page which is under the WP Cerber admin menu and click the Diagnostic tab
  3. Scroll down to the Server Environment Variables section (Server Info section in older versions of WP Cerber)
  4. Find your IP address in one of those lines that are displayed in the section
  5. In the left part of the line with your IP address, you see a key in the square brackets. For instance, it can be: [HTTP_X_REAL_IP] => 292.168.1.1.
  6. Now you have to take the key HTTP_X_REAL_IP and add the following string (with your key) to the beginning of the wp-config.php file (after the line with <?php)
    define('CERBER_IP_KEY', 'HTTP_X_REAL_IP' );
Server Info section on the Diagnostic tab WordPress

The Server Info section on the Diagnostic tab

Note: The HTTP_X_REAL_IP is shown as an example, you have to find out and use your own key.

Last posts from WordPress security blog


I'm a team lead in Cerber Tech. I'm a software & database architect, WordPress - PHP - SQL - JavaScript developer. I started coding in 1993 on IBM System/370 (yeah, that was amazing days) and today software engineering at Cerber Tech is how I make my living. I've taught to have high standards for myself as well as using them in developing software solutions.

View Comments