Real IP and Geo for Cloudflare

From the Cloudflare Support website:

Q: Why do my server logs show Cloudflare’s IPs using Cloudflare?

A: When you sign on to Cloudflare the way your logs are displayed will change because Cloudflare acts as a proxy. This means that your visitors are routed through the Cloudflare network. This allows Cloudflare to stop attacks before they reach your network. It also allows Cloudflare to speed up page load time by more efficiently routing packets and, more importantly, caching static resources (images, javascript, css, etc.) on a very fast connection. However, as a result, the connecting IP will always come from the Cloudflare network.

As a result, commenters‘ IP will also be masked by Cloudflare. Luckily, Cloudflare sends the real user’s IP in a separate header. This plugin saves it, as well as the user’s geo-location (also provided by Cloudflare), and displays this information in the admin panel.

Note that when the blog is served directly to the internet (not through Cloudflare), anyone can spoof any IP address and geo-location by specifying any value in the request headers.