What the check looks at
B2 looks at a request from an IPv6 visitor, your own admin visit or a stored one. When CF-Connecting-IP holds an address from 240.0.0.0/4 (the Class E space), Cloudflare is overwriting the visitor address. When a separate Cf-Pseudo-IPv4 header is present, Cloudflare is only adding one.
Like every request Edge Doctor sends, these go only to the hosts of your Site Address and WordPress Address (home_url() and site_url()). An address WordPress gives on another host, such as a single sign on page, is never requested.
Results and what they mean
| Result | What it means |
|---|---|
| PassedConfidence: High | IPv6 visitors reach your server as themselves An IPv6 visitor was seen and the address was passed through unchanged. |
| InfoConfidence: High | Pseudo IPv4 is adding a header The real address stays where everything expects it. Nothing to change. |
| WarningConfidence: High | Pseudo IPv4 is replacing the visitor address An IPv6 visitor reaches your server as a made up address. Anything that reads the usual header records an address that belongs to nobody. |
| Could not checkConfidence: Low | This check could not be completed No request with Cloudflare headers could be read. |
| Not applicable | No IPv6 visitor seen yet, so there is no Pseudo IPv4 address to check Reason not_observed. Open the report from a connection with IPv6 to give the check something to read. |
| Not applicable | Cloudflare is not in front of this site Check A1 did not detect Cloudflare, so this check sent no request. Reason not_behind_cloudflare. |
When the result names a reason
not_observed: The plugin has not seen this happen on your site.token_missing: The test request never reached your server, so there was nothing to compare.no_snapshot: This check needs a recent visit through Cloudflare. Open the Edge Doctor report once and it will have one.qs_ignored: Your cache key ignores the query string, so the plugin cannot test a page without risking a cached copy of it. Before it asks for any private address, the plugin requests your home page twice with a different unique query string. If either answer is aHIT, your cache key ignores the query string, and a test request could store a private page under an address visitors use. So the plugin stops and sends nothing.not_behind_cloudflare: This site is not behind Cloudflare.
Symptoms you may notice
- Comments, orders or logs show addresses that start with 240 to 255, which no real visitor has.
- Blocking or rate limiting by address treats unrelated IPv6 visitors as the same made up address, or misses them.
Why it happens
Pseudo IPv4 exists for origins that understand only IPv4 addresses. With Overwrite Headers Cloudflare replaces Cf-Connecting-IP and X-Forwarded-For with a pseudo IPv4 address and keeps the real one in CF-Connecting-IPv6; with Add Header it only adds Cf-Pseudo-IPv4 (Cloudflare: Pseudo IPv4). WordPress handles IPv6 addresses, so it does not need either.
Confirm it by hand
From a connection that has IPv6, open https://example.com/cdn-cgi/trace and read the ip= line: an IPv6 address there is what Cloudflare sees. Then compare it with the address your server recorded for the same visit (server access log, or a test comment under Comments).
How to fix it
In Cloudflare: set Pseudo IPv4 to Add Header, which keeps the real address where everything expects it, or to Off.
In WordPress: nothing to change. Addresses already recorded stay as they were.
Limitations
B2 needs a request from an IPv6 visitor. Until one is seen, the result is Not applicable, even if the setting is on.
Related checks
- B1 Real visitor IP not restored: whether the server restores the visitor address at all.
- B3 Local proxy or Tunnel in front of WordPress: a proxy or Tunnel in front of WordPress.
Sources
Run this check on your own site with Edge Doctor for Cloudflare®, free on WordPress.org.
Edge Doctor for Cloudflare® is not affiliated with or endorsed by Cloudflare, Inc. Cloudflare is a registered trademark of Cloudflare, Inc.