Configure Trusted Proxy Addresses for Reliable QCDR IP Targeting

When Joomla sits behind a reverse proxy, load balancer, or CDN, QCDR must distinguish the trusted intermediary from an untrusted visitor-supplied forwarding header. The trust list in Settings > Runtime Safety controls that boundary.

How QCDR Chooses the Client IP

QCDR first reads the direct connection address from REMOTE_ADDR. If that address is not a valid IP, client-IP targeting cannot qualify the request. If it is valid but is not in the trusted-proxy list, QCDR uses that direct address and ignores X-Forwarded-For.

Only when the direct address exactly matches a trusted proxy address or falls inside a trusted proxy CIDR does QCDR inspect X-Forwarded-For. It then uses the first valid IP in that comma-separated header.

Configure the Trust List

  1. Open Components > QC Dynamic Replacer > Settings.
  2. Find Runtime Safety.
  3. Under Trusted proxy addresses or CIDR ranges, enter the direct proxy/CDN addresses that are allowed to supply forwarded client IPs, one per line.
  4. Use a single IP or CIDR. The current proxy-trust check does not interpret the start-to-end range syntax used by Rule/Token IP targeting.
  5. Save and retest from a known client connection.

Trust the Proxy, Not the Internet

The entries belong to your controlled proxy/CDN layer, not to the visitors you want to target. Do not broadly trust every possible source address: if an untrusted client can connect directly through an address you marked trusted, it may be able to supply a misleading X-Forwarded-For header.

Header Scope in 1.1.05

The current QCDR resolver specifically examines X-Forwarded-For after the direct proxy is trusted. It does not generically consume every vendor-specific “real IP” header. Make sure your proxy stack supplies the header QCDR actually reads.

Verify End to End

Test an Include-only IP Rule from one address that should match and one that should not. If both requests behave the same, check the proxy trust list, the actual direct connection address seen by PHP, the forwarded header supplied by the proxy, and any full-page/CDN caching.

Community Discussion

Want to compare workflows, share practical tips, or discuss how you use this QCDR feature? Visit the QC Dynamic Replacer Community. For private support, bug reports, account-specific issues, or feature requests, use the QuantaCade support system.