By default, iThemes Security will try to find the correct proxy header to use automatically. However, we highly recommend manually selecting the header your proxy service uses or disabling it completely if your website is not behind a proxy. Otherwise, IP detection might not be accurate, allowing attackers to bypass lockouts.