How can we help?
Guides, troubleshooting steps and answers for Winfrasoft products. Ask a question, browse the articles below, or open a ticket.
Autothenticator
- Passkeys in Autothenticator Every use needs user verification: a fingerprint, face, device PIN, Windows Hello or the passphrase. An unlocked vault isn't enough, because a passkey is a...
Autothenticator
- The Autothenticator vault: encryption and unlocking Encryption: every account is encrypted with its own key (AES-256-GCM). Those keys are wrapped by the vault key: 256 random bits, made on the person's first...
Autothenticator
- Autothenticator and your privacy No ads, no tracking, no analytics in any app or extension. Free users never create an account, and nothing leaves the device (apart from the leaked-password...
Autothenticator
- Autothenticator platforms and apps One product, one vault format, and the same features on every platform.
Autothenticator
- Autothenticator Business and Enterprise Moving from Business to Enterprise needs no migration. The key service joins each member's vault as one more device.
Autothenticator
- Autothenticator editions Free is not a trial. It never expires and nothing is held back on one device. Codes, autofill and export never depend on sync or on our servers being...
Autothenticator
- What Autothenticator is Autothenticator is an authenticator for two-factor (2FA) one-time codes, made by Winfrasoft. It does what Google Authenticator or Microsoft Authenticator do...
Autothenticator
- Codes from text messages on Android Nothing is kept. The text is read once for its code, and never stored, logged, synced or sent anywhere. The code is kept in memory for at most 10 minutes...
Autothenticator
- Importing and exporting accounts All importing happens on the device. Files are never uploaded anywhere.
Autothenticator
- Syncing Autothenticator across devices (Pro and Business) The relay: sync goes through Winfrasoft's sync service at eu.sync.autothenticator.com. It stores and forwards encrypted data, and holds no key that opens it...
Autothenticator
- Moving phones, backups and recovery On the new device, choose Move from another device on the first screen. It shows a QR code and a code to type, such as K7Q2 9F4M · 042 917. On the old...
Autothenticator
- Autothenticator quick answers Autothenticator quick answers
Autothenticator
- Filling codes only on the right site (phishing protection) Each account is bound to the sites (and, on Android, apps) where it may be filled.
Autothenticator
- What if…? Autothenticator security scenarios Your sign-in reaches the website, not your data. Each device has its own key. The vault key is random, and passes only between your own devices.
X-Forwarded-For for IIS
- Logging the real client IP in IIS behind F5 BIG-IP IIS behind an F5 BIG-IP logs the SNAT address, not the visitor. Enable Insert X-Forwarded-For on the HTTP profile and log the real client IP in IIS.
X-Forwarded-For for IIS
- SharePoint behind a reverse proxy: the real client IP SharePoint web front-ends behind a reverse proxy log the proxy address, not the visitor. How to get the real client IP into c-ip across a WFE farm.
X-Forwarded-For for IIS
- IIS custom field for X-Forwarded-For not working X-Forwarded-For custom log field in IIS missing, empty or full of dashes? The nine causes, starting with the log file name change nobody expects.
X-Forwarded-For for IIS
- How to log X-Forwarded-For in IIS Log X-Forwarded-For in IIS: the custom log field on IIS 8.5+, Advanced Logging on IIS 7-8, the PowerShell method, and why the column does not fix c-ip.
X-Forwarded-For for IIS
- IIS client IP for SIEM and compliance SIEM connectors, geo-IP lookups and compliance parsers all key off the IIS c-ip field. Why a custom X-Forwarded-For column does not satisfy them.
X-Forwarded-For for IIS
- Logging the real client IP on IIS behind ARR With IIS Application Request Routing (ARR) as a reverse proxy, backend IIS logs the ARR server IP. Log the real client IP using the X-Forwarded-For header.
X-Forwarded-For for IIS
- ASP.NET Core UseForwardedHeaders behind a proxy UseForwardedHeaders still seeing the proxy IP? Why KnownProxies and KnownNetworks reject it, why ForwardedHeaders__KnownProxies__0 is ignored, and .NET 10.
X-Forwarded-For for IIS
- Logging the real client IP in IIS behind Cloudflare IIS behind Cloudflare logs the edge IP, not the visitor. How to log the real client IP from CF-Connecting-IP, True-Client-IP or X-Forwarded-For.
X-Forwarded-For for IIS
- Barracuda and IIS 10: the Advanced Logging route is gone Barracuda's IIS instructions start with Microsoft Advanced Logging, which no longer exists. What still works on IIS 10, and what it will not fix.
X-Forwarded-For for IIS
- X-Forwarded-For and IIS IIS does not read X-Forwarded-For natively, in any version including IIS 10. What the header holds, why c-ip shows your proxy, and the options you have.
X-Forwarded-For for IIS
- Logging the real client IP in IIS behind Barracuda IIS behind a Barracuda WAF or Load Balancer ADC logs the appliance, not the visitor. Barracuda sends X-Forwarded-For by default: log it in IIS c-ip.
X-Forwarded-For for IIS
- Logging the real client IP in IIS behind Akamai Akamai sends X-Forwarded-For by default and True-Client-IP only if enabled. Which to log in IIS, why True-Client-IP can be forged, and how to fix c-ip.
X-Forwarded-For for IIS
- Logging the real client IP in IIS behind an AWS load balancer An AWS ALB or ELB makes IIS log the load balancer's private IP. Read X-Forwarded-For and record the real visitor IP in the standard c-ip field.
X-Forwarded-For for IIS
- Logging the real client IP in IIS behind Nginx or HAProxy Nginx and HAProxy do not forward the client IP by default. Add X-Forwarded-For with proxy_set_header or option forwardfor, and log it in IIS.
X-Forwarded-For for IIS
- X-Forwarded-For and IIS: frequently asked questions Common questions on logging the real client IP in IIS: the c-ip field versus a custom column, CF-Connecting-IP, X-Azure-ClientIP and spoofing.
X-Forwarded-For for IIS
- Which client IP header does your proxy send? Which client IP header each proxy sends: X-Forwarded-For, CF-Connecting-IP, True-Client-IP, X-Azure-ClientIP, C-IP and X-ARR-LOG-ID, and which to log.
X-Forwarded-For for IIS
- X-Forwarded-For for IIS Log the real client IP in the standard IIS c-ip field, with Proxy Trust List anti-spoofing. Supported on IIS 10, Windows Server 2016 to 2025.
X-Forwarded-For for IIS
- Exchange behind a load balancer: the real client IP Exchange behind an F5, NetScaler or Azure Application Gateway logs the load balancer, not the client. How to fix the OWA and ActiveSync audit trail.
X-Forwarded-For for IIS
- Replacing the F5 X-Forwarded-For ISAPI filter on IIS 10 F5 archived its X-Forwarded-For ISAPI filter and HTTP module in 2016. Microsoft says neither works on IIS 10, and neither validates the header.
X-Forwarded-For for IIS
- Logging the real client IP in IIS behind Azure App Gateway / Front Door IIS behind Azure Application Gateway or Front Door logs the Azure IP. Use X-Azure-ClientIP or X-Forwarded-For to log the real visitor in c-ip.