In short. Apache logs the request client IP with %a and the connection peer with %{c}a; mod_remoteip selects forwarded client addresses according to proxy trust settings.
Definition: Behind a proxy, Apache's connection peer is the server that connects directly to it. Apache's
mod_remoteipmodule can replace the request's client IP with an address supplied through a trusted proxy;%alogs that request address, while%{c}apreserves the connection peer address.
Key facts
- As of 17 October 2026, Apache's Log Files documentation warns that the address in its common log example can belong to an intermediary proxy.
- Apache's log format reference defines
%aas the request's client IP and%{c}aas the connection's underlying peer IP. - Apache's mod_remoteip documentation states that configuring
RemoteIPHeaderwithout proxy trust directives makes the module trust all hosts presenting that header's IP value.
Why does the access log show a proxy address?
A proxy forwards requests between a client and Apache. The Log Files guide explains that its common log format begins with %h, the remote host field. With HostnameLookups enabled, Apache attempts to log a hostname in place of the IP address. The guide warns that an intermediary proxy can supply the address visible in this field.
The mod_log_config reference specifies that HostnameLookups Off is the default. An existing log's first column therefore needs to be interpreted against its configured format: %h represents a remote hostname or address, %a represents the request's client IP, and %{c}a represents the underlying connection peer.
How does Apache select a forwarded client address?
The mod_remoteip reference documents RemoteIPHeader, which names the request header carrying client addresses, and RemoteIPTrustedProxy, which identifies proxies allowed to supply them. Its trusted proxy example includes these lines:
RemoteIPHeader X-Forwarded-For
RemoteIPTrustedProxy proxy.example.com
Here, proxy.example.com is Apache's example hostname. A site's configuration needs to identify its actual trusted proxy. The module's replacement address also affects IP based authorization through Require ip.
For a comma separated address chain, the module processes addresses from right to left. It stops when an address is untrusted to supply the preceding address. The replacement applies for the duration of the request, including when a load balancer reuses a connection for different clients.
How can a log retain both addresses?
The log format reference allows literal labels alongside address fields. The following composed example records the request address and connection peer in a separate access log:
LogFormat "client=%a peer=%{c}a" client_peer
CustomLog "logs/client_peer.log" client_peer
client contains the address selected for the request, including any replacement by mod_remoteip. peer contains the underlying connection address. Apache's Log Files guide states that a relative access log filename is resolved against ServerRoot.
The mod_remoteip documentation also provides %{remoteip-proxy-ip-list}n for logging the module's intermediate proxy note.
Related terms
- Server log analysis
- How do I record crawler user agents in Apache access logs?
- How do I verify an OpenAI crawler request?
- How do I check whether a request really comes from Googlebot?
FAQ
Can I log X-Forwarded-For as the original address chain?
Apache's mod_remoteip documentation says it rewrites the header to the remaining unconfirmed addresses, or removes it when all addresses are trusted. Logging %{X-Forwarded-For}i can therefore capture a modified value. The log format reference describes copying a header with mod_setenvif into an environment variable and logging it with %{VARNAME}e to preserve an earlier value.
Which directive accepts forwarded private client addresses?
The same module reference specifies that RemoteIPInternalProxy trusts private client addresses supplied by the listed proxies. RemoteIPTrustedProxy leaves reported private addresses in the header instead of accepting them as the client IP.
Sources
- Apache Software Foundation, "Log Files", undated
- Apache Software Foundation, "Apache Module mod_log_config", undated
- Apache Software Foundation, "Apache Module mod_remoteip", undated
Check how a page reads to answer engines. Open the GEO score analyzer