diff --git a/lib/api_log.php b/lib/api_log.php
index 6d21c6b..ce8b22a 100644
--- a/lib/api_log.php
+++ b/lib/api_log.php
@@ -305,7 +305,12 @@ function qdb_api_log_finish(): void
 
 function qdb_api_log_client_ip(): string
 {
-    foreach (['HTTP_X_FORWARDED_FOR', 'HTTP_X_REAL_IP', 'REMOTE_ADDR'] as $key) {
+    foreach ([
+        'HTTP_CF_CONNECTING_IP',
+        'HTTP_X_FORWARDED_FOR',
+        'HTTP_X_REAL_IP',
+        'REMOTE_ADDR',
+    ] as $key) {
         $v = trim((string)($_SERVER[$key] ?? ''));
         if ($v === '') {
             continue;
@@ -313,7 +318,9 @@ function qdb_api_log_client_ip(): string
         if ($key === 'HTTP_X_FORWARDED_FOR') {
             $v = trim(explode(',', $v)[0]);
         }
-        return $v;
+        if (filter_var($v, FILTER_VALIDATE_IP)) {
+            return $v;
+        }
     }
     return '';
 }
diff --git a/website/css/style.css b/website/css/style.css
index 41ec9fb..60bd1de 100644
--- a/website/css/style.css
+++ b/website/css/style.css
@@ -343,6 +343,14 @@ code {
     font-size: 0.85rem;
     vertical-align: top;
 }
+.activity-log-ip {
+    font-size: 0.8rem;
+    white-space: nowrap;
+    vertical-align: top;
+}
+.activity-log-ip code {
+    font-size: 0.78rem;
+}
 .activity-log-subject strong,
 .activity-log-actor strong {
     color: var(--text);
diff --git a/website/js/pages/dev.js b/website/js/pages/dev.js
index fa9c6c0..a2625d2 100644
--- a/website/js/pages/dev.js
+++ b/website/js/pages/dev.js
@@ -89,6 +89,7 @@ export function devPage() {
                             <th>Subject</th>
                             <th>Method</th>
                             <th>Route</th>
+                            <th>IP</th>
                             <th>Status</th>
                             <th>Duration</th>
                             <th>Values</th>
@@ -96,7 +97,7 @@ export function devPage() {
                         </tr>
                     </thead>
                     <tbody id="activityLogBody">
-                        <tr><td colspan="9" style="text-align:center;color:var(--text-secondary);padding:20px">Loading…</td></tr>
+                        <tr><td colspan="10" style="text-align:center;color:var(--text-secondary);padding:20px">Loading…</td></tr>
                     </tbody>
                 </table>
             </div>
@@ -294,7 +295,7 @@ async function loadActivityLog() {
 
     const date = document.getElementById('activityLogDate')?.value || new Date().toISOString().slice(0, 10);
     const activity = document.getElementById('activityLogKind')?.value || '';
-    tbody.innerHTML = '<tr><td colspan="9" style="text-align:center;padding:20px">Loading…</td></tr>';
+    tbody.innerHTML = '<tr><td colspan="10" style="text-align:center;padding:20px">Loading…</td></tr>';
 
     try {
         const q = new URLSearchParams({ date, limit: '300' });
@@ -314,7 +315,7 @@ async function loadActivityLog() {
         }
 
         if (!entries.length) {
-            tbody.innerHTML = '<tr><td colspan="9" style="text-align:center;color:var(--text-secondary);padding:24px">No activity recorded</td></tr>';
+            tbody.innerHTML = '<tr><td colspan="10" style="text-align:center;color:var(--text-secondary);padding:24px">No activity recorded</td></tr>';
             return;
         }
 
@@ -327,6 +328,7 @@ async function loadActivityLog() {
             const dur = e.duration_ms != null ? `${e.duration_ms} ms` : '—';
             const subject = formatActivitySubject(e);
             const performedBy = formatActivityPerformer(e);
+            const ip = (e.ip && String(e.ip).trim()) ? String(e.ip).trim() : '—';
             const errPart = e.error
                 ? `<div class="error-text" style="margin-top:6px;font-size:.8rem">${escHtml(e.error)}</div>`
                 : '';
@@ -336,6 +338,7 @@ async function loadActivityLog() {
                 <td class="activity-log-subject">${subject}</td>
                 <td><code>${escHtml(e.method || '')}</code></td>
                 <td><code>${escHtml(e.route || '')}</code></td>
+                <td class="activity-log-ip"><code>${escHtml(ip)}</code></td>
                 <td>${escHtml(status)}</td>
                 <td>${escHtml(dur)}</td>
                 <td class="activity-log-changes-cell">${renderActivityChanges(e.changes)}</td>
@@ -344,7 +347,7 @@ async function loadActivityLog() {
         }).join('');
     } catch (err) {
         if (meta) meta.textContent = '';
-        tbody.innerHTML = `<tr><td colspan="9" class="error-text" style="padding:16px">${escHtml(err.message)}</td></tr>`;
+        tbody.innerHTML = `<tr><td colspan="10" class="error-text" style="padding:16px">${escHtml(err.message)}</td></tr>`;
     }
 }