nginx real_ip configuration conflicts with IP-based blocking

critical

configurationUpdated Feb 2, 2026(via Exa)

Sources

JS Bin down in 2026remysharp.com

Technologies:

Expresssubject

NGINXThe root cause of this issue originates in NGINX

CloudflareCloudflare metrics correlate with this issue and help confirm diagnosis

How to detect:

When set_real_ip_from is configured alongside IP-based blocking rules, nginx rewrites $remote_addr to the original client IP, causing legitimate CloudFlare requests to be dropped with 444 status

Recommended action:

Remove or carefully audit set_real_ip_from directives when implementing IP allowlisting; use CloudFlare header checks ($http_cf_ray) for validation instead of IP-based blocking