Home Assistant Now Sees the Real IP Address of Every Visitor

What was wrong before

Home Assistant uses the visitor's IP address in three places that matter for security: failed login notifications, the login history, and IP banning. With every request arriving from the same internal address, all three were close to useless:

• Login notifications said "Login attempt failed from 10.150.0.1" — the address of the Pluggie endpoint, not of whoever typed the wrong password.
• IP banning had to stay off. A single ban would have blocked the endpoint address, and with it every visitor, including you.
• Logs and automations that react to the client address could not tell your own devices from anyone else.

What changes in 0.7.0

• Real addresses in notifications and logs. A failed login now shows the public IP address of the device that tried.
• IP banning works per visitor. Home Assistant can ban the address that keeps guessing passwords without locking out anyone else.
• Visitors cannot fake their address. An X-Forwarded-For header sent by the visitor is ignored. Home Assistant only receives the address that Pluggie actually saw.
• Geo and IP filtering in your dashboard is unchanged. It has always been applied to the real address at the Pluggie relay, before a connection ever reaches your network.

How it works — and what it does not change

The Pluggie relay accepts the visitor's connection, so it knows the visitor's IP address. It now passes that address to the Pluggie app on your device in a small header placed in front of the encrypted stream. The format is the PROXY protocol, an open standard used by load balancers and reverse proxies.

Nothing about encryption changes. TLS is still terminated on your own device, with a certificate that is generated and stored there. The relay still forwards encrypted bytes it cannot read — the address header travels next to the encrypted stream, not inside it. If you want the full technical picture of what the relay can and cannot see, read Can Pluggie See Your Traffic?

On your device, the Pluggie app reads the address and hands it to Home Assistant in the standard X-Forwarded-For header. Home Assistant already trusts that header from Pluggie, because that is exactly what the one-time trusted proxy setting is for.

What you need to do

Turning on IP banning (optional)

With real addresses available, Home Assistant's built-in IP banning becomes useful. In Home Assistant 2026.8 or newer:

1. Open Settings → System → Network and find the HTTP server section.
2. Turn on Enable IP banning.
3. Set Login attempts before ban, for example 5. Leaving Unlimited login attempts on disables banning.
4. Save. Home Assistant restarts, and you have to confirm the new settings afterwards — otherwise they are reverted after 5 minutes.

On versions older than 2026.8, the same options are ip_ban_enabled: true and login_attempts_threshold: 5 in the http: section of configuration.yaml.

How to check that it works

Open your Pluggie address on your phone with Wi-Fi turned off, and enter a wrong password once. Home Assistant shows a "Login attempt failed" notification. It should list your phone's public IP address — not an internal 10.x.x.x address.

Using the Pluggie Docker container with other services?

The same improvement applies to anything you run behind the Pluggie Docker container. Your service receives the visitor's real address in the X-Forwarded-For header. It will only use it if it trusts the Pluggie container as a proxy — the same idea as in Home Assistant, configured with set_real_ip_from in nginx or RemoteIPTrustedProxy in Apache.