Skip to main content

Cloudflare Setup

Extendy GeoShield supports Cloudflare deployments through CF-Connecting-IP mode.

This mode is designed for WHMCS installations where browser traffic reaches the WHMCS origin through Cloudflare, and Cloudflare provides the original visitor IP address in the CF-Connecting-IP header.

When to use Cloudflare mode​

Use Cloudflare mode only when:

  • WHMCS is actually behind Cloudflare;
  • the immediate request source seen by WHMCS is expected to be a Cloudflare edge address;
  • direct access to the WHMCS origin server is restricted where possible;
  • you want Extendy GeoShield to use CF-Connecting-IP for GeoIP lookup and event context.

Do not use Cloudflare mode for generic reverse proxies. For non-Cloudflare proxy setups, see Proxy Setup.

Configuration steps​

In the Extendy GeoShield Settings page:

  1. Set Client IP Source to:

    CF-Connecting-IP

  2. Save the settings.

  3. Perform a controlled client login through the Cloudflare-proxied hostname.

  4. Review the Login Events Log.

Expected successful Cloudflare behaviour:

  • IP Source Used is CF-Connecting-IP;
  • IP Source Verified is yes;
  • the resolved IP address is a valid public client IP;
  • the event can proceed to GeoIP lookup when a provider is configured.

Header verification​

Extendy GeoShield does not trust CF-Connecting-IP only because the setting is enabled.

Before accepting the header, the resolver checks whether REMOTE_ADDR belongs to the addon’s bundled Cloudflare IP ranges.

If REMOTE_ADDR is not Cloudflare:

  • CF-Connecting-IP is ignored;
  • the resolver falls back safely to REMOTE_ADDR;
  • IP Source Verified is no;
  • the event may have no IP address if the fallback address is private, local, reserved, or otherwise not a valid public client IP.

This protects against direct requests to the origin server that include a spoofed Cloudflare header.

Bundled Cloudflare IP ranges​

Extendy GeoShield uses a bundled snapshot of Cloudflare IPv4 and IPv6 ranges.

The addon does not download Cloudflare ranges during login. This avoids network calls and dependency on an external update path during authentication-related processing.

The bundled ranges must be reviewed and refreshed before production release and during future addon maintenance or release cycles.

If the bundled Cloudflare range list becomes stale, Extendy GeoShield should fail safely by ignoring CF-Connecting-IP and falling back instead of blindly trusting the header.

Origin access protection​

For best results, configure your infrastructure so the WHMCS origin accepts public web traffic only from Cloudflare where possible.

If the origin server is directly reachable:

  • spoofed CF-Connecting-IP headers should still be rejected by Extendy GeoShield because REMOTE_ADDR will not match Cloudflare;
  • login events may fall back to direct origin peer addresses;
  • country detection can become incomplete if the fallback address is private or local;
  • your deployment remains exposed to direct-origin access risks outside Extendy GeoShield.

Extendy GeoShield is not a firewall and does not replace origin access controls.

Login Events visibility​

Use the Login Events Log to review Cloudflare mode behaviour.

Relevant fields include:

  • IP Address — the resolved public client IP when available.
  • IP Source Used — normally CF-Connecting-IP when Cloudflare verification succeeds.
  • IP Source Verified — yes only when the header source was verified as acceptable to use.

IP Source Verified does not mean the visitor or IP address is safe. It only means Extendy GeoShield accepted the configured IP source/header according to its verification rules.

Relationship to GeoIP and alerts​

After Cloudflare mode resolves a valid public client IP, Extendy GeoShield can use that IP for GeoIP country lookup.

If the IP cannot be resolved safely, the login event is still logged, but country detection may fail. The addon then follows the Alert When Country Detection Fails setting.

For provider setup, see GeoIP Providers Overview.

For alert behaviour, see Alert Modes.