When IIS sits behind Cloudflare, your logs show Cloudflare's edge IP addresses instead of your real visitors. Here's why that happens, and how to record the true client IP in the standard IIS log using the X-Forwarded-For header.
Short answer. Cloudflare terminates each visitor's connection at its edge and opens a fresh one to your origin, so IIS logs a Cloudflare edge IP in c-ip. The visitor's real address arrives in the X-Forwarded-For header, which IIS does not read natively. Install an ISAPI filter that reads that header and writes the real address into the standard c-ip field, trusting only Cloudflare's published ranges so the header can't be spoofed.
Cloudflare is a reverse proxy: every request to your site is terminated at a Cloudflare edge server, which then opens a fresh connection to your origin IIS server. As far as IIS is concerned, the TCP connection comes from Cloudflare — so the c-ip field in your IIS logs fills up with Cloudflare edge IP addresses, and your geolocation, reporting, rate-limiting and security tooling all lose sight of the real visitor.
Cloudflare preserves the original visitor address and passes it to your origin in HTTP request headers, chiefly:
X-Forwarded-For: the de facto standard header, containing the visitor's IP (and any further proxy hops).CF-Connecting-IP: a Cloudflare-specific header holding just the visitor's IP.The catch: IIS doesn't read either header natively. Microsoft never built X-Forwarded-For support into IIS, so the headers arrive but are never written to the log. That's the gap Winfrasoft X-Forwarded-For for IIS fills.
Winfrasoft X-Forwarded-For for IIS is an ISAPI web filter that reads the X-Forwarded-For header Cloudflare adds and writes the real visitor's address into the standard IIS c-ip log field, with no change to your applications or log format. A Proxy Trust List ensures only Cloudflare's hops are trusted, so the genuine visitor is logged and the header can't be spoofed.
IISRESET so the trust list takes effect.C:\inetpub\logs\LogFiles\). The c-ip field should now show real visitor addresses instead of Cloudflare edge IPs.Lock down your origin too. Restoring the visitor IP only stays trustworthy if attackers can't reach your origin directly and forge an X-Forwarded-For header. Restrict your origin firewall (or IIS IP restrictions) to accept traffic only from Cloudflare's published ranges, and consider Cloudflare Authenticated Origin Pulls. That way the only source of the header is Cloudflare itself.
Because Cloudflare is a reverse proxy. Your origin receives the connection from a Cloudflare edge server, so IIS logs the Cloudflare IP in c-ip. The real visitor is in the X-Forwarded-For header, which IIS doesn't log without a filter.
Cloudflare sends both. X-Forwarded-For is the cross-vendor standard and preserves the full proxy chain, so it can be validated against a trust list, which is what X-Forwarded-For for IIS uses. CF-Connecting-IP is a single-value, Cloudflare-only header.
In practice, almost nothing: both carry the single client address Cloudflare accepted the connection from, and when both are present they should hold the same value. The difference is history and availability. CF-Connecting-IP is Cloudflare's own header and is sent on every plan. True-Client-IP originated at Akamai and became the de facto name for "the one real client address", so Cloudflare emits it too, but only on Enterprise plans, where it exists mainly so you can move off Akamai without rewriting anything that reads it. If you are choosing between them, prefer CF-Connecting-IP on Cloudflare because it is always there. If you need the value to survive a change of CDN, prefer X-Forwarded-For, which both of them duplicate and which every other vendor also sets.
Yes. Add both Cloudflare's ranges and your internal load balancer's IPs to the Proxy Trust List. The filter walks the chain from the web server outward and logs the first untrusted address (the real visitor) even through multiple tiers.
Restore real visitor IPs in your IIS logs behind Cloudflare. Available now for IIS 10 on Windows Server 2016–2025, with a free 14-day trial.
View the product or request a download →