How to Restore Visitor IPs Using mod_remoteip

When traffic passes through a proxy source like Cloudflare or Nginx, Apache may log the proxy’s IP address as the client’s IP instead of the original visitors. By enabling Apache’s mod_remoteip module, you can restore and log the true visitors IP address, ensuring accurate tracking of your site traffic.

Follow the steps:

Access the server’s command line as the ‘root’ user via SSH or “Terminal” in WHM.
Install the ea-apache24-mod_remoteip package.
1. CentOS 7 or CloudLinux 7 –
  yum install ea-apache24-mod_remoteip
2. CloudLinux 8/9, AlmaLinux 8/9, or Rocky Linux 8/9 –
  dnf install ea-apache24-mod_remoteip
3. Ubuntu –
  apt install ea-apache24-mod_remoteip
Open the /etc/apache2/conf.modules.d/370_mod_remoteip.conf file using your preferred text editor.
Input the subsequent line under the LoadModule line.
RemoteIPHeader X-Forwarded-For
Add the proxy IP addresses as entries in the configuration file.
1. Use ‘RemoteIPTrustedProxy’ for specifying remote IP addresses.
  RemoteIPTrustedProxy 203.0.113.2
2. Use ‘RemoteIPInternalProxy’ for specifying local IP addresses.
  RemoteIPInternalProxy 192.0.2.2
  
  Please note that IP address ranges can be specified using CIDR notation.
Save your changes and close the text editor.
Log in to WHM as the ‘root’ user.
Navigate to Home > Service Configuration > Apache Configuration > Global Configuration.
Scroll down to the LogFormat (combined) option and select the textbox.
Replace the default text with the following:
%a %l %u %t \”%r\” %>s %b \”%{Referer}i\” \”%{User-Agent}i\”
Next, select the textbox for the LogFormat (common) option.
Replace the default text with the following:
%a %l %u %t \”%r\” %>s %b
Scroll to the bottom of the page and click the Save button.
Finally, click the Rebuild Configuration and Restart Apache button.