Sucuri Firewall Blocking IP Nos and Not showing "guests"

[Willie]

God attacked a couple of weeks ago. 40,000 "guests" up from 1200 average daily guests. Purchased firewall, Sucuri.net.  Now my "guests" only report 11.      I know it is wrong because I have a solid group who are not users, but read regularly, especially at a particular time of the week and day. When the attack began, and the firewall went up, the numbers went down to almost nothing.

In checking with Securi, they told me there was many visitors, in the thousands still coming to the site, but not showing in my CPanel or Simple Machines "Whose Online."

Is this something others have experienced? I could not find anything here when searching Securi. If so, what can I do to get my Whose Online reporting accurately?  As usual the blame always goes elsewhere.

[Arantor]

Who's Online reports the users that get to SMF. If the users don't get to SMF, they cannot be reported in Who's Online.

And if they're not in CPanel, they're not getting to the server either, so it definitely isn't SMF (because if it was, you'd see them in CPanel).

Sounds to me like something is wrong with the way Securi is set up.

[Willie]

Here is what cpanel is now reporting.  Something is not right.  And the firewall's ip no is what we see for our guests and users.

[Arantor]

Yup, still looks like Securi is not set up right, but I have no idea how it is "meant" to be set up, I'm afraid.

[delta5]

I had this problem. Sucurri has a code snippet work-around that allows you to see the true hostmask and ip address instead of the ones assigned by the firewall.

[delta5]

if(isset($_SERVER['HTTP_X_SUCURI_CLIENTIP']))
{
    $_SERVER["REMOTE_ADDR"] = $_SERVER['HTTP_X_SUCURI_CLIENTIP'];
}

[Willie]

Thanks Delta5. Where do I place the code?