Sit behind Cloudflare and every request in your Apache logs shows Cloudflare’s IP instead of the visitor’s. Restoring the real IP matters for rate limiting, geo-blocks and accurate logs.

What you need: Apache with mod_remoteip available and Cloudflare in front of the site.

Install mod_remoteip

Enable mod_remoteip — it is the modern replacement for mod_rpaf and is bundled with Apache.

Trust only Cloudflare

Point RemoteIPHeader at CF-Connecting-IP and list Cloudflare’s published IP ranges as trusted proxies, so clients cannot spoof the header.

Update the log format

Swap %h for %a in your log format so the restored address is what gets recorded.

a2enmod remoteip
# in the vhost or a conf file:
RemoteIPHeader CF-Connecting-IP
RemoteIPTrustedProxy 173.245.48.0/20 103.21.244.0/22

How it works, in detail

Behind Cloudflare every connection comes from a Cloudflare IP, so Apache logs and IP-based rules see the proxy instead of the visitor. mod_remoteip fixes this by trusting a header, but only for the IP ranges you explicitly allow; trusting X-Forwarded-For blindly lets anyone spoof an address and bypass rate limits. Cloudflare publishes its ranges, so you configure RemoteIPTrustedProxy with that list and map CF-Connecting-IP. Once done, update the log format from %h to %a so the corrected address is what gets written.

Trust only the proxy ranges you actually use. Trusting X-Forwarded-For blindly is how attackers forge their way past IP-based rules.