English (US) Deutsch Español (España) Français (France) 日本語 한국어 Português do Brasil 简体中文

Cloudflare Help Center

Detailed system status >

Articles in this section

Connect with the Cloudflare Community

Get answers

Understanding the True-Client-IP Header

  • Updated

Learn how to see end-user IP addresses in origin requests with Cloudflare's True-Client-IP Header.

Overview

Connections from Cloudflare to origin servers come from Cloudflare IPs. True-Client-IP is a solution that allows Cloudflare users to see the end user’s IP address, even when the traffic to the origin is sent directly from Cloudflare.

This feature is only available to Enterprise users.

When the True-Client-IP feature is enabled, Cloudflare adds a True-Client-IP header to the request sent to the origin with the IP address of the end user.

True-Client-IP supplements the current CF-Connecting-IP and X-Forwarded-For headers. We recommend relying on the CF-Connecting-IP (or True-Client-IP) instead of X-Forwarded-For headers if you need the actual client (visitor) IP address.

If you are using Cloudflare in a stacked CDN — that is, using multiple CDN providers stacked together serially — and authenticating HTTP requests based on the IP address value in the True-Client-IP header, you must enable True-Client-IP. If you do not enable this feature, the True-Client-IP header can be spoofed to any value. Alternatively, if you do not want to receive the True-Client-IP header, use a Transform Rule to remove this HTTP request header.

Enable True-Client-IP Header

To enable the True-Client-IP header,

  1. Log in to your Cloudflare account.
  2. Navigate to the Network app of the Cloudflare dashboard.
  3. For True-Client-IP Header, select On.

Not finding what you need?

Searching can help answer 95% of support questions. This is the quickest way to get answers.

Ask the Community Submit a request

Related articles

Not finding what you need?

Ask the Community Submit a request