cloudflare / Cloudflare-WordPress

A Cloudflare plugin for WordPress
https://www.cloudflare.com/wordpress/
BSD 3-Clause "New" or "Revised" License
208 stars 84 forks source link

FEATURE: Check to confirm if PHP REMOTE_ADDR is set properly #533

Open jordantrizz opened 5 months ago

jordantrizz commented 5 months ago

Confirmation

WordPress version

6.4.3

Cloudflare-WordPress version

4.12.4

PHP version

8.0

Expected result

There are tests to ensure that PHP's REMOTE_ADDR is correctly providing non-Cloudflare IP's as per this article.

https://snicco.io/blog/how-to-safely-get-the-ip-address-in-a-wordpress-plugin

I would go further and put in detection to confirm the site is proxied.

Actual result

A warning that PHP's REMOTE_ADDR is misconfigured or spoofed.

Steps to reproduce

  1. Install Cloudflare Plugin

Additional factoids

No response

References

No response