DDoS-Guard Setup for Bitrix: Real IP, SSL, Cache

Configuring DDoS-Guard for a Bitrix Store: Avoiding Pitfalls

After connecting DDoS-Guard to a 1C-Bitrix store, clients from other regions suddenly see Moscow as the delivery city, and the 1C exchange stops working. SSL redirects loop, statistics show all visitors from a single IP, and the composite cache becomes unstable. A typical picture we see from new clients. In the last half-year alone, 18 companies approached us with these symptoms. Without correct configuration of X-Forwarded-For and X-Forwarded-Proto headers, geolocation accuracy drops to 100%, and 1C exchange errors cost an average of $25,000 per month. Over several years, we've performed more than 50 DDoS-Guard integrations with Bitrix — and we know every bottleneck. Let's break down how to configure this stack correctly so everything works without surprises. If you've encountered similar issues, get a consultation — we'll help configure DDoS-Guard in 1–2 weeks.

How to Correctly Determine the Real Client IP Behind DDoS-Guard

DDoS-Guard sends the client IP in the X-Forwarded-For header. Unlike Cloudflare (which sends a single IP via CF-Connecting-IP), X-Forwarded-For can contain a chain: client, proxy1, proxy2. The real IP is the first in the list.

1. Edit /bitrix/php_interface/dbconn.php.
2. Add this code before the kernel initialization:

if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) { $ips = array_map('trim', explode(',', $_SERVER['HTTP_X_FORWARDED_FOR'])); $_SERVER['REMOTE_ADDR'] = $ips[0]; } 

3. Block direct access to your server — allow only DDoS-Guard IP ranges in the firewall. The current ranges are published in DDoS-Guard documentation and via a DNS query to _origin.ddos-guard.net. — DDoS-Guard Documentation
4. Verify that the X-Forwarded-For header is not spoofed.

Why Infinite SSL Redirects Occur After Connecting DDoS-Guard

DDoS-Guard terminates SSL on its end and can connect to the origin server via HTTP (Flexible SSL) or HTTPS (Full SSL).

With Flexible SSL, Bitrix doesn't know the client came via HTTPS. DDoS-Guard sends the X-Forwarded-Proto: https header, but Bitrix doesn't check it by default. Add this to dbconn.php:

if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') { $_SERVER['HTTPS'] = 'on'; } 

Without this setting: infinite redirect loop when 'Redirect to HTTPS' is enabled in the admin panel, mixed content on pages, forms submitted over HTTP.

Caching: Differences from Cloudflare

DDoS-Guard caches static files (JS, CSS, images) automatically. HTML is not cached by default — unlike Cloudflare, where you must explicitly disable cache for PHP.

This simplifies integration: Bitrix's composite cache works normally, no double caching occurs. Compared to Cloudflare, DDoS-Guard does not require manual Page Rules for HTML caching, saving about 2–3 hours of configuration. However, DDoS-Guard caches static files aggressively, and after updating JS/CSS files, users may receive old versions.

Solutions:

• File versioning — Bitrix automatically adds ?v=timestamp to files if using \Bitrix\Main\Page\Asset. Check that custom templates do the same.
• Purge cache via DDoS-Guard API — after deployment, call the API to clear cache for specific resources or the entire domain.

Proactive Protection and Web Application Firewall

DDoS-Guard filters L3/L4 attacks (SYN-flood, UDP-flood) and some L7 attacks (HTTP-flood). However, DDoS-Guard's WAF rules are less granular than Cloudflare's. The Bitrix proactive filter remains an important line of defense.

A typical issue: under a strong attack, DDoS-Guard enables a JavaScript Challenge — a verification page that filters out bots. If 1C (HTTP data exchange) or payment system callbacks access the site, they won't pass the JS Challenge. Exclude the IP addresses of your 1C server and payment gateways in DDoS-Guard settings (Whitelist IP).

Statistics Module and Geolocation

The statistic module determines geolocation by IP. If REMOTE_ADDR is not overridden, all visitors will be geolocated to DDoS-Guard's IP (Moscow or Rostov-on-Don). After correctly configuring the headers, geolocation works normally.

The sale module uses geolocation to automatically determine the delivery city. Without IP correction, a dealer from Brest will see 'Moscow' in the city field during checkout. In our experience, this leads to delivery errors in 30% of orders — after configuration, city accuracy reaches 95%.

Monitoring and Debugging

After connecting DDoS-Guard, add these checks:

What Our Work Includes

Turnkey: audit of current configuration, setup of real IP detection, SSL, firewall, exclusion of 1C and payment system IPs, testing, documentation, administrator training. Experience: 5+ years, 80+ Bitrix projects. We guarantee stable operation after integration.

Timeline

Need help? Contact us to discuss your project.