Cloudflare Visitor IP in Apache: mod_remoteip Setup

Last updated: 30 October 2026

When a site sits behind Cloudflare, Apache sees Cloudflare's addresses instead of your visitors'. That breaks access logs, IP-based rules and security tools. The fix is to restore the visitor IP from the CF-Connecting-IP header. This guide shows the supported way with mod_remoteip, which replaces the old mod_cloudflare module.

In this guide

• Why the visitor IP is wrong
• Set up mod_remoteip
• On cPanel servers
• Verify
• FAQ
• Sources

Why the visitor IP is wrong

Cloudflare proxies requests, so the connection to your server comes from a Cloudflare address. The real visitor address arrives in the CF-Connecting-IP header. Apache has to be told to trust that header, but only when the request really comes from Cloudflare.

Set up mod_remoteip

These steps follow Cloudflare's Debian and Ubuntu example. Paths differ on other systems.

1. Enable the module:

   sudo a2enmod remoteip

2. In the site configuration add:

   RemoteIPHeader CF-Connecting-IP

3. In /etc/apache2/apache2.conf change %h to %a in the combined LogFormat:

   LogFormat "%a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined

4. Create /etc/apache2/conf-available/remoteip.conf with one trusted proxy line for every range on cloudflare.com/ips:

   RemoteIPHeader CF-Connecting-IP
   RemoteIPTrustedProxy 192.0.2.0/24

   (The address above is a documentation placeholder; use the real ranges.)
5. Enable, test and restart:

   sudo a2enconf remoteip
   sudo apache2ctl configtest
   sudo systemctl restart apache2

On cPanel servers

cPanel uses EasyApache 4 instead of the Debian layout. Install the mod_remoteip package through EasyApache 4 in WHM, then add the same directives through the Apache include editor so they survive rebuilds. Do not edit the generated httpd.conf directly. Check the cPanel documentation for your version.

Verify

• Open your access log and confirm visitor IPs differ from Cloudflare's ranges.
• Check that firewalls and rate limiters see real visitor addresses.
• Update the trusted proxy list whenever Cloudflare changes its ranges.

FAQ

Why not keep mod_cloudflare?

Cloudflare says it no longer updates or supports it. Use mod_remoteip.

Is it safe to trust CF-Connecting-IP?

Only for requests that come from Cloudflare addresses. That is why you list Cloudflare ranges as trusted proxies.

Does Cloudflare support mod_remoteip?

Cloudflare notes it was created by an outside party and cannot provide technical support for it.

Sources

• Cloudflare: Restoring original visitor IPs

More on this site: Security guides · All IT guides