PayFast "Bad source IP address" behind Cloudflare

Your PayFast log says Bad source IP address (or "invalid source") and orders stay pending. Your site uses Cloudflare, Sucuri, a load balancer or another reverse proxy.

Why it happens

PayFast's integration rules ask plugins to check that each notification really came from PayFast. A plugin does that by comparing the sender's IP address with the IPs of PayFast's hosts (www.payfast.co.za, w1w.payfast.co.za, w2w.payfast.co.za and sandbox.payfast.co.za).

Behind a proxy, your server sees the proxy's IP address, not PayFast's. The check fails even though the notification is genuine. PayFast's own help centre names this: the error "is often due to the use of a proxy server". A WooCommerce PayFast issue on GitHub reports the same thing with Cloudflare.

Fix 1: give your server the real visitor IP

Cloudflare sends the original IP in the CF-Connecting-IP header, and most proxies send X-Forwarded-For. On Apache, mod_remoteip with Cloudflare's IP ranges restores the real IP for the whole site. Many hosts can switch this on for you. This is the cleanest fix because every plugin then sees the right address.

Fix 2: use the plugin's proxy setting

Some PayFast plugins can read the forwarded header themselves. Only turn that on if all traffic really passes through the proxy, otherwise anyone could fake the header.

Fix 3: rely on the other checks

The source IP is one of four checks. The signature, the amount match and the server confirmation call (your store asks PayFast to confirm the notification at /eng/query/validate) still protect you. WooCommerce documents a developer filter for this in its own PayFast plugin. Only do this if the other checks are on.

Our plugin