WPIntell

Source evidence

Not using X-Forwarded-For?

Login Lockdown & Protection · support · 2024-04-16T10:29:00+00:00

Login Lockdown & Protection plugin evidence original source source API
neutralsentiment
highseverity
0.52relevance
1replies
Evidence linked to opportunitycommercial context

Proof Health

Open evidence

Commercial opportunities need traceable source links before they are treated as build-worthy.

8 / 34 rows with source links

23.5% of this page's analysis has direct source links.

0 build-decision rows missing links

0 rows here require auditable proof before promotion.

26 rows with no attached evidence

0 rows have source counts but still need direct links.

Conversation

support
narcisgarcia resolved
I’ve tried plugin on a website behind a reverse proxy. It seems to take only client address from server variable REMOTE_ADDR, although HTTP_X_FORWARDED_FOR is provided by web service. Then Login Lockdown plugin is blocking all logins because it assumes all of them have same (proxy) IP address. HTTP_X_FORWARDED_FOR is just a header that the client can set to whatever they wish ( https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For ) so you should never rely on it for security. Your host should configure your server properly and returns it in REMOTE_ADDR

Comments

1 shown
Alexandru Tapuleasa 2024-04-17T08:25:00+00:00

HTTP_X_FORWARDED_FOR is just a header that the client can set to whatever they wish ( https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For ) so you should never rely on it for security. Your host should configure your server properly and returns it in REMOTE_ADDR