IP addresses show as 127.0.0.1 in logs when Imunify360-webshield is in use

Symptoms

With Imunify360 webshield, you find that IP addresses are still being logged as from localhost (127.0.0.1). This is in the cPanel access logs, login logs, and the .lastlogin file in user accounts.

CONFIG_TEXT: [2026-06-19 12:45:46 +0000] warn [cpaneld] proxy trust miss: X-Forwarded-For ignored; localhost peer [127.0.0.1:58312:10.2.34.70:2083] peer UID=975 untrusted
[2026-06-19 12:45:46 +0000] warn [cpaneld] proxy trust miss: X-Forwarded-For ignored; localhost peer [127.0.0.1:58320:10.2.34.70:2083] peer UID=975 untrusted

Cause

cPanel internal interface tracking doesn't allow the Imunify360 webshield as a trusted connection. This is caused by recent updates that more closely track the proxy connections in the cPanel interfaces. We have opened an internal case, CPANEL-54119, with our developers to further review this behavior. 

Resolution

Disable the Imunify360 Webshield.

1. Navigate to the menu located at "WHM Home / Imunify360 / Settings" (gear icon).
2. Within this menu, there will be the subsection "WebShield" where you will need to toggle off "enable webshield".