Member Avatar for Nollyvenon

How can I get the Machine IP of visitors of my website logged.

I've used

function getIp(){

$ip = $_SERVER['REMOTE_ADDR'];
if($ip){
if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
$ip = $_SERVER['HTTP_CLIENT_IP'];
} elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
$ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
}
return $ip;
}

BUt what I get is my server IP.

Thanks

  • 3 Contributors
  • 2 Replies
  • 276 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by matrixdevuk

Dani AI

Generated

— seeing the server's IP in REMOTE_ADDR usually means the site is behind a reverse proxy/load‑balancer (shared hosting, nginx proxy, AWS ELB, Cloudflare, etc.), so REMOTE_ADDR is the proxy's address. and were right to check headers, but those snippets miss two important points: X‑Forwarded‑For can contain multiple comma‑separated addresses, and any header can be spoofed unless it comes from a trusted proxy.

A practical approach:

  • Inspect var_export($_SERVER, true) to see which headers the proxy sets (e.g. HTTP_CF_CONNECTING_IP, HTTP_X_REAL_IP, HTTP_X_FORWARDED_FOR).
  • Configure the proxy (or the web server real‑ip module) to pass the client IP and to only accept those headers from known proxy IPs.
  • In PHP, parse X‑Forwarded‑For safely: split the list, validate each IP, and return the first valid public IP. Only do this parsing if REMOTE_ADDR is a trusted proxy.

Example PHP helper (validate and prefer public IPs; pass known proxy IPs to trust):

<?php
function getClientIp(array $trustedProxies = [], $default = '0.0.0.0') {
    $srv = $_SERVER ?? [];
    $remote = $srv['REMOTE_ADDR'] ?? '';

    // If request did not come via a trusted proxy, REMOTE_ADDR is the client
    if ($remote && !in_array($remote, $trustedProxies, true)) {
        return $remote;
    }

    $candidates = [
        'HTTP_CF_CONNECTING_IP', 'HTTP_X_REAL_IP',
        'HTTP_X_FORWARDED_FOR', 'HTTP_CLIENT_IP'
    ];

    foreach ($candidates as $h) {
        if (empty($srv[$h])) continue;
        $parts = array_map('trim', explode(',', $srv[$h]));
        foreach ($parts as $ip) {
            if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
                return $ip;
            }
        }
    }

    return ($remote && filter_var($remote, FILTER_VALIDATE_IP)) ? $remote : $default;
}

Caveats: never trust those headers blindly — only when they originate from known proxy IPs or are enforced by the host; otherwise headers can be forged. If the server is managed (hosting provider, Cloudflare, ELB), prefer configuring the proxy/server (nginx real_ip, Cloudflare settings) to expose the real client IP and document the trusted proxy IP ranges.

Recommended Answers

All 2 Replies

Member Avatar for Masterblank 
function getIp(){ 

    if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
        $ip = $_SERVER['HTTP_CLIENT_IP'];
    } 
    elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
        $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
    } 
    else{
        $ip = $_SERVER['REMOTE_ADDR'] ? $_SERVER['REMOTE_ADDR'] : "";
    }
    return $ip; 
}
Member Avatar for matrixdevuk

That could be simplified a lot and improved.

function getIp($ifNull = "") { # allow specification of null value
    if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
        return $_SERVER['HTTP_CLIENT_IP'];
    } elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
        return $_SERVER['HTTP_X_FORWARDED_FOR'];
    }

    return $_SERVER['REMOTE_ADDR'] ? $_SERVER['REMOTE_ADDR'] : $ifNull;
}

getIp("127.0.0.1");
>> IP or 127.0.0.1 if it can't find it
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.