← All guides

Reverse Proxy: Check forwarding of the visitor IP at the origin

Requirement

Use read access to reverse proxy and origin configuration as well as a controlled test request.

Search for X-Forwarded-For, X-Real-IP, CF-Connecting-IP, True-Client-IP, RemoteIPHeader and real_ip_header. If the origin does not need the original IP, the forwarding can be specifically reduced depending on the proxy.

The specific read-only commands are collected under Check the website yourself.

Rate result

A single hit is a technical finding. Then check the purpose, actual storage, transfer and retention period of the affected level separately.

Classify in the overall check

This individual test only covers one level. Then systematically check the remaining levels using the checklist for unnecessary visitor data .

Related guides

• Caddy: Reconstruct original IP behind reverse proxy only if necessary
• Cloudflare: Don't share visitor IP to origin
• PHP: Check REMOTE_ADDR and passed client IP
• Matomo: Remove original IP before the tracker

Sources and verification

This guide is based on multiple current sources. Vendor documentation is not treated as proof that every concrete installation automatically follows the same privacy characteristics.

• Self-test
• Inspection checklist

Important: IP processing is not IP storage

An IP address has to be processed to establish and deliver a network connection. Hosting providers, firewalls or DDoS protection may also process or retain it for a limited time for security purposes. No Logging distinguishes this security layer from unnecessary persistent visitor logging by the website, application and ordinary access logs.