Is there a way to stop Drupal from tracking or collecting IP addresses of visitors? The specific need case is for a site that wishes to be able to say no identifying information is kept of visitors (it sounds seedier than it actually is).

I recognize that Apache logs are going to do this, and that will need to be handled separately, but I'm wondering if there's any way to prevent this in Drupal (or if you have suggestions on how to obfuscate incoming visitor IPs, that would be helpful as well)

  • 3
    Why not just put a proxy in front of the web server? Then you can control what IP is sent to it, and you don't need to touch Drupal. Or Apache
    – Clive
    Oct 9, 2016 at 16:40
  • 3
    In fact you wouldn't even need to do that, you could do it directly in Apache config or PHP itself. e.g. in settings.php $_SERVER['REMOTE_ADDR'] = '';. Drupal won't know/care that it hasn't received the real IP. If you wanted to obfuscate instead, you could do it there too
    – Clive
    Oct 9, 2016 at 16:50
  • Hi, did you find a solution for these issues? Thx
    – CodeNext
    Feb 9, 2017 at 10:11

3 Answers 3


As mentioned in clives comment you could override $_SERVER['REMOTE_ADDR'] in your settings.php to obfuscate incoming visitor IPs. Drupal's ip_address() function than would return your obfuscated IP to any module that attempts to log IPs (like dblog).

Just be aware that any static or random address would conflict with a part of Drupal's flood control mechanism (the part that blocks IPs after too many failed login attempts; default: 50 within one hour). A static IP would expose you to the risk of locking every user out of the system. A random IP would render it useless.

Hashing the IP should work. The module cryptolog seems to to what you want and takes care of the flood control issue. From its project page:

Cryptolog enhances user privacy by logging ephemeral identifiers rather than actual client IP addresses in Drupal's database tables and syslog.

When Cryptolog is enabled, Drupal 8's \Drupal::request()->getClientIP() and Drupal 7's ip_address() output a 128-bit HMAC of the client IP address (in IPv6 notation), using a salt that is stored in memory and regenerated each day.

Because Cryptolog uses the same unique identifier per IP address for a 24-hour period, it is still possible to do some statistical analysis of the logs such as counting unique visitors per day. In addition, unlike other solutions of setting $_SERVER['REMOTE_ADDR'] to either one static IP address or a completely random IP address, Drupal's flood control mechanisms still function as normal.


Disable Statistics module ( or you have visitor or better_statistics module disable them too).

Drupal by default don't save visitor IP's without enable or install any module.

  • Hi, as stated, if I am not using statistics module, so can I write in my website's privacy policy that, My site(D8 sute) does not collect your IP address or any user data just by viewing the site pages. I understand that, Login is totally different thing. And does drupal collect IP address, If anonymous user comments? Very thanks for Info, I am stuck, help needed.
    – CodeNext
    Feb 9, 2017 at 10:15

I think it is impossible to do not collect visitor IP address without modifying Drupal's core code directly.

Drupal collects the visitor IP address using the function ip_address().

As you can see in the code of that function, it doesn't invoke any hook or something similar to let you modify the IP before to return it. With one hook there you could think on, for example, remove the last octet of the IP, what would anonymize your visitors.

Drupal uses the IP to register what visitors do. And it stores the IP when the user logs in, in comments, in watchdog and syslog events, in poll votes, etc. And it is only for Drupal itself. But a lot of Drupal contributed modules would use the IP for their own purposes.

  • 1
    Hi, Is it true for Drupal 8 also, Does drupal 8 also collect IP address of visitors? Thx.
    – CodeNext
    Feb 5, 2017 at 12:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.