or even if I can do it with the info that cPanel provides
Nothing to do with cPanel; it's best done in your own HTML. Within your existing page footer-- assuming you've already got something, whether an SSI or a php include-- add something along these lines (this is my current version, but I think incrediBill created the original code):
if (!function_exists('getallheaders'))
{
function getallheaders()
{
$headers = '';
foreach ($_SERVER as $name => $value)
{
if (substr($name, 0, 5) == 'HTTP_')
{ $headers[str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($name, 5)))))] = $value; }
}
return $headers;
}
}
$ip = get_server('REMOTE_ADDR');
$fh = fopen($_SERVER['DOCUMENT_ROOT'] . "/boilerplate/headers-". date('Ymd') . ".log","a");
fwrite($fh, date('Y-m-d:') . date("H:i:s\n"));
fwrite($fh, "IP: $ip\n");
foreach (getallheaders() as $name => $value)
{
fwrite($fh, "$name: $value\n");
}
fwrite($fh, "----\n\n");
fclose($fh);
I don't generally care for using code that I don't personally understand-- I speak about three words of php, and this function uses more than those three-- but it works as intended.
Note this bit:
fopen($_SERVER['DOCUMENT_ROOT'] . "/boilerplate/headers-". date('Ymd') . ".log","a")
That's where you set the name and location of the file that will store each day's headers. The "a" flag means "add to this file if it exists, and create one if it doesn't". I happen to have a directory called /boilerplate/ so I used that. You don't have to use the .log extension but it seemed most practical, since that's what your access and error logs use. (I've instructed my computer to open everything with .log extension in SubEthaEdit. I think it defaulted to Terminal, or at best TextEdit.)
This version works only on pages-- that is, anything that happens to have a footer. But I've included the code on my custom 403 page, so request headers from blocked robots get recorded along with all the others. In the rare case of a blocked image or pdf request, even those headers will get logged, because the server sends back the same 403 page regardless. This is sometimes useful if you're trying to figure out why the request was denied.
Unlike access/error logs, this is a file stored in your personal webspace. So it will stay there forever; I go in every few weeks, download to my HD, and delete all but the current day's file. What you do with the logs is up to you. I tend to keep them for a few months in case I think of something to check.
All this is just for your information. If you simply want to handle requests differently depending on where they "really" came from, you might have something like
RewriteCond %{HTTP_FORWARDED} ^11\.22\.33
... and then whatever you want the rule to do. If, instead of a number, you just say . or !. it means "If this header exists (or doesn't exist) at all".
