I'm not going to dive into why but even with SSL and dedicated IP that would not be a factor.
But why would you write it's disguised? The source IP is the VPN one and that's by design. I would be guessing you want a host IP but here my host IP on my LAN is 192.168.10.11 What good is that since that's a non-routable IP? I'm using a router so same effect as me using a VPN. My IP is disguised!
My bet is there's more to your story. Keep writing.
On my web site?
First of all, should I definitely have to have SSL and dedicated IP ?
What can I do at backend to achieve this?
TIA!

Chowhound
Comic Vine
GameFAQs
GameSpot
Giant Bomb
TechRepublic