In this guide
- A CDN or proxy in front of your server replaces the visitor's IP with its own. The real IP is in a header such as
X-Forwarded-Foror a CDN-specific one. - Read the header only from your own CDN, because anyone can send a fake header.
- Ad platforms use the IP for matching and analytics for location, so it matters.
Many ad and analytics tags want the visitor's IP address and user agent. If a CDN such as Cloudflare sits between the visitor and your tagging server, the connection your server sees comes from the CDN, not the visitor. Tags that read "the IP of the request" will send the CDN's address to Meta and Google, and your location data and match quality suffer. This page explains where the real IP lives, how to read it and how to do it safely. See also GA4 IP anonymization and Meta event match quality.
Where the real IP is
| Header | Set by | Notes |
|---|---|---|
X-Forwarded-For | Most proxies and load balancers | A list of addresses. The first is the original client, the rest are proxies. Easy to forge if you do not control the first hop. |
CF-Connecting-IP | Cloudflare | The single original visitor IP, set by Cloudflare |
True-Client-IP | Some CDNs (for example Akamai, Cloudflare Enterprise) | The original client IP |
X-Real-IP | Some reverse proxies | The client IP, as the proxy saw it |
Which one you have depends on your CDN. Check its documentation.
Runs on your domain, anywhere
Your tracking runs on your own domain, so a visit from any country is handled the same way.
Read it in the server container
Open server Preview and a request
Look at the request headers list.
Find the header that holds the visitor's IP
For Cloudflare, cf-connecting-ip.
Create a request header variable
Name it after the header.
Use it where tags need the IP
For example set ip_override for GA4, or pass it as the client IP to the Meta Conversions API.
Test
Compare the value with your own public IP.
Security: do not trust a header you do not control
A visitor can send their own X-Forwarded-For header. If your server is reachable directly, bypassing the CDN, an attacker can put any IP in the header. Two protections: only accept the header from your CDN's address ranges, and, where possible, only let the CDN reach the server. If neither is possible, use the CDN-specific header that the CDN overwrites, such as CF-Connecting-IP on Cloudflare.
Check your tracking in one pass
This is an example. Run the check on your own site to see where yours stands.
Location headers
Some CDNs add the visitor's country, region, city and postcode as headers. Open Tracked's Visitor Location power-up reads those headers and adds them to events sent to Meta, TikTok and Google Ads. On Cloudflare you turn on the managed option that adds visitor location headers. Without the headers, location values stay empty and nothing is sent. The country is usually there, and region, city and postcode only when the CDN is set to send them.
Anonymizing
If you do not want the full IP to reach your container, Open Tracked's Anonymizer power-up can zero the last part of the address or remove it. Location headers from the CDN are unaffected, because they are derived at the edge.
Common problems
X-Forwarded-For header contains several.Watch events arrive, live
A sample feed. In Open Tracked you see the same stream for your own store.
Frequently asked questions
Why does my server see the CDN's IP?
The connection comes from the CDN. The visitor's IP is passed in a header.
Which header has the real IP?
X-Forwarded-For on most proxies, CF-Connecting-IP on Cloudflare, True-Client-IP on some CDNs.
Is it safe to trust X-Forwarded-For?
Only if it comes from your own CDN. Visitors can forge it.
How do I get the visitor's country?
From a location header your CDN adds. Open Tracked's Visitor Location power-up reads them.
Can I hide the IP from my container?
Yes, with the Anonymizer power-up.
Do I need spreadsheets to read my results?
No. Once tracking is live, the Open Tracked analytics shows spend, revenue, ROAS and profit, and you can ask Ari, the built-in AI assistant, questions about your own numbers in plain words. Ari's allowance depends on your analytics plan.
Is Open Tracked different from Open Track or Open Space Track?
No. Open Tracked is the official name of our server-side tracking platform, and the website is opentracked.io. Many people search for it as Open Track, OpenTrack or Open Space Track. All of them lead to the same product: server-side Google Tag Manager hosting, first-party analytics and a CRM pipeline.
Fix your tracking at the source
Open Tracked hosts your server-side Tag Manager, keeps first-party cookies alive and shows what each ad is really worth.
The Open Tracked team
We build Open Tracked: server-side tracking hosting, analytics and the tools around them, for stores that spend on ads. Questions about this guide, or an idea for the next one?
Comments
Loading comments...
Integrations · 5 min read
