Trusted Proxies in Easy MCP AI
When a reverse proxy, load balancer or CDN sits in front of your site, every request reaches WordPress from the proxy's own address rather than the visitor's. Easy MCP AI then treats all visitors as one: they share a single rate-limit allowance, one client retrying a stale token can trigger the failed-login lockout for everyone, the IP whitelist can only be satisfied by listing the proxy itself, and every row in the Audit Log records the proxy's address. This guide explains how to tell the plugin which proxy to trust so it can read the real visitor address again.
In this article
When you need this
You need this only when both of the following are true:
- A proxy, load balancer or CDN (Cloudflare, Sucuri, an nginx or HAProxy front end, a hosting-provider edge) forwards requests to your WordPress server.
- Your web server does not already restore the real address itself.
To find out, open Easy MCP AI → Dashboard and check the diagnostic named Client IP resolves per visitor. A warning saying the site appears to be behind a proxy means this guide applies. A pass means nothing needs to change.
Prefer the server-level fix when you can
Configuring the web server to restore the real address corrects WordPress core and every other plugin at once, not just Easy MCP AI. On Apache this is the mod_remoteip module with RemoteIPHeader and RemoteIPTrustedProxy; on nginx it is set_real_ip_from and real_ip_header. Many managed hosts already do this. Use the plugin's own setting when you cannot change the server configuration.
How it works
The plugin never reads a forwarded header on its own, because those headers are written by whoever sends the request and anyone can forge one. Instead it checks the address the connection actually came from. If that address belongs to a proxy you have named as trusted, the plugin reads the forwarded header that proxy writes. If the connection came from anywhere else, the connecting address is the visitor and no header is read.
This means two facts have to be declared, and only the site owner knows them:
| What to declare | Why |
|---|---|
| The address or address ranges of the proxy | So only requests that genuinely passed through it have their header believed. |
| Which header the proxy writes the visitor's address into | Different proxies use different headers. |
Declare the proxy
Both values are set as constants in wp-config.php, above the line that reads /* That's all, stop editing! Happy publishing. */.
define( 'EASY_MCP_AI_TRUSTED_PROXIES', '127.0.0.1, 10.0.0.0/8' );
define( 'EASY_MCP_AI_CLIENT_IP_HEADER', 'X-Forwarded-For' );EASY_MCP_AI_TRUSTED_PROXIES is a comma-separated list of IP addresses or CIDR ranges, IPv4 or IPv6. An entry that is not a valid address or range is ignored, so a typo can never widen trust. Leave the constant undefined, or set it to an empty string, to switch the feature off.
EASY_MCP_AI_CLIENT_IP_HEADER names the header your proxy sets. It is optional and defaults to X-Forwarded-For. The accepted values are:
| Value | Typically set by |
|---|---|
X-Forwarded-For | Most proxies and load balancers. The plugin reads it from right to left and uses the first address that is not itself a trusted proxy, so a chain of proxies resolves correctly. |
CF-Connecting-IP | Cloudflare. |
X-Real-IP | nginx. |
True-Client-IP | Akamai and Cloudflare Enterprise. |
Any other value falls back to X-Forwarded-For.
Cloudflare
Enter Cloudflare's published address ranges as the trusted proxies and select CF-Connecting-IP as the header. The current ranges are listed at cloudflare.com/ips and change rarely.
define( 'EASY_MCP_AI_TRUSTED_PROXIES', '173.245.48.0/20, 103.21.244.0/22, 103.22.200.0/22, 103.31.4.0/22, 141.101.64.0/18, 108.162.192.0/18, 190.93.240.0/20, 188.114.96.0/20, 197.234.240.0/22, 198.41.128.0/17, 162.158.0.0/15, 104.16.0.0/13, 104.24.0.0/14, 172.64.0.0/13, 131.0.72.0/22, 2400:cb00::/32, 2606:4700::/32, 2803:f800::/32, 2405:b500::/32, 2405:8100::/32, 2a06:98c0::/29, 2c0f:f248::/32' );
define( 'EASY_MCP_AI_CLIENT_IP_HEADER', 'CF-Connecting-IP' );A proxy on the same server
When the proxy runs on the same machine as WordPress, requests arrive from the loopback address. Declare it:
define( 'EASY_MCP_AI_TRUSTED_PROXIES', '127.0.0.1, ::1' );Check that it works
- Open Easy MCP AI → Dashboard and press Re-run checks. The Client IP resolves per visitor diagnostic should now pass. If it warns that trusted proxies are configured but the request still resolved to the proxy, the address shown in its evidence is the one that delivered the request; add it to the list, or check that the header you selected is the one your proxy sends.
- Make any request to the MCP endpoint, for example from your AI client, then open Easy MCP AI → Audit Log. The IP Address column of the newest row should show the visitor's address rather than the proxy's.
What the resolved address is used for
Once a trusted proxy is declared, the resolved visitor address is what the plugin uses for:
- per-IP rate limits on the OAuth endpoints;
- the lockout that follows repeated failed authentication attempts;
- the IP Whitelist under Easy MCP AI → Settings, which applies to API keys and OAuth grants alike;
- the IP Address column in the Audit Log.
It is never used to decide whether a request may use plain HTTP for OAuth. That check keeps reading the connecting address on purpose, so a forwarded loopback address cannot unlock HTTP-only OAuth.
A forged header changes nothing
A visitor who is not on the trusted list cannot pick their own address by sending a forwarded header: the plugin only reads the header when the connection itself came from a trusted proxy. Keep the list limited to addresses you control or that your CDN publishes.
Developers
The easy_mcp_ai_client_ip filter runs after the resolution above and receives the resolved address; returning a different valid address overrides it. Two further filters, easy_mcp_ai_trusted_proxies and easy_mcp_ai_client_ip_header, receive the values read from the constants and can replace them, which is useful when the proxy list must come from another source.