Review a request finding

1. Open Findings and select a retained observation or minute group.
2. Review the recorded pattern, method, minimized path, source quality and response effect. A concerning pattern is a reason to investigate.
3. Open Source and verification to see the configured address source and run the harmless Observer self-test when needed.
4. If your site uses a proxy, ask the server administrator to establish the exact trusted boundary before changing Address source.

Actual connection peer is the default. The alternative is Explicit trusted proxies and X-Forwarded-For, using reviewed proxy addresses or CIDRs. The immediate connection peer must match the trust set before forwarding data is considered. Other forwarding headers are ignored.

Save request-source configuration only after confirming control of that boundary. Changing it invalidates dependent exact-source targets. A derived or masked address is network context, not a person's identity.

The observer sees requests reaching the WordPress plugin layer. Static files, cache hits and upstream responses may not reach it. A successful self-test covers its one routed request, not the whole site. Admitted observations are not a count of all traffic or unique attackers.