How to Get the Client IP Address in PHP (Safely and Correctly)

PHP provides the client IP address through the $_SERVER superglobal. For a website that receives requests directly from visitors, the usual value is $_SERVER['REMOTE_ADDR'].

The following one line is enough for the basic case:

<?php

$clientIp = $_SERVER['REMOTE_ADDR'] ?? '';

echo htmlspecialchars($clientIp, ENT_QUOTES, 'UTF-8');

This value represents the IP address of the system that connected directly to your web server. It may be the visitor, but it may also be a reverse proxy, load balancer, CDN, or another network gateway.

This distinction matters because request headers such as X-Forwarded-For can be sent or modified by the visitor. They should not automatically take priority over REMOTE_ADDR.

Quick answer

Use REMOTE_ADDR when your server receives requests directly:

<?php

function getClientIp(): string
{
    $ipAddress = $_SERVER['REMOTE_ADDR'] ?? '';

    if (filter_var($ipAddress, FILTER_VALIDATE_IP) === false) {
        return '';
    }

    return $ipAddress;
}

echo htmlspecialchars(getClientIp(), ENT_QUOTES, 'UTF-8');

The null coalescing operator prevents an undefined array key warning if REMOTE_ADDR is unavailable. The filter_var() call confirms that the returned value is a valid IPv4 or IPv6 address.

When you run this example locally, the detected address will usually be 127.0.0.1 or ::1. Both represent your own computer. The value ::1 is the IPv6 loopback address.

The PHP client IP address demo running locally. The value ::1 is the IPv6 loopback address.

You can learn more about the values supplied by the web server in this guide to the PHP $_SERVER variable. The PHP manual also documents the available server variables.

If your application is behind a trusted proxy or CDN, you need an additional step. You must first confirm that REMOTE_ADDR belongs to that trusted service. Only then should you inspect the forwarding header configured by that service.

Which method should you use?

The correct way to get the client IP address depends on how your PHP application is deployed.

If you are unsure which environment your application runs in, start with REMOTE_ADDR. Only add support for forwarded headers when your infrastructure requires it.

Get the client IP address behind a proxy or CDN

If your application is behind a reverse proxy, load balancer, or CDN, REMOTE_ADDR may contain the proxy’s IP address instead of the visitor’s. In this case, the proxy usually adds another header that contains the original client IP.

Examples include:

• X-Forwarded-For
• CF-Connecting-IP (Cloudflare)
• X-Real-IP

However, these headers should not be trusted automatically. A visitor can send these headers in a direct request unless your web server is behind a trusted proxy that removes or replaces them.

A safe approach is:

1. Read REMOTE_ADDR.
2. Check whether that IP belongs to one of your trusted proxies.
3. Only then read the forwarded header configured by that proxy.

The following example demonstrates this approach.

<?php

class ClientIpResolver
{
    private array $trustedProxies = [
        // Add your trusted proxy IPs or CIDR ranges here.
        // '203.0.113.10',
    ];

    public function getClientIp(): string
    {
        $remoteAddr = $_SERVER['REMOTE_ADDR'] ?? '';

        if (!$this->isValidIp($remoteAddr)) {
            return '';
        }

        if (!$this->isTrustedProxy($remoteAddr)) {
            return $remoteAddr;
        }

        if (!empty($_SERVER['HTTP_CF_CONNECTING_IP'])) {
            return $this->validatedIp($_SERVER['HTTP_CF_CONNECTING_IP']) ?? $remoteAddr;
        }

        if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
            $addresses = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']);

            foreach ($addresses as $address) {
                $address = trim($address);

                if ($this->isValidIp($address)) {
                    return $address;
                }
            }
        }

        return $remoteAddr;
    }

    private function isValidIp(string $ip): bool
    {
        return filter_var($ip, FILTER_VALIDATE_IP) !== false;
    }

    private function validatedIp(string $ip): ?string
    {
        return $this->isValidIp($ip) ? $ip : null;
    }

    private function isTrustedProxy(string $ip): bool
    {
        return in_array($ip, $this->trustedProxies, true);
    }
}

$resolver = new ClientIpResolver();

echo $resolver->getClientIp();

This example keeps the logic simple for learning purposes. In a production application, your trusted proxy list should match the infrastructure in front of your web server. For example, if you use Cloudflare, keep its published IP ranges up to date and use the CF-Connecting-IP header only after confirming that the request came from Cloudflare.

For more details about the X-Forwarded-For header and its security considerations, see the MDN documentation.

Common mistakes when getting the client IP address

Most examples on the internet work for simple cases but overlook important details. Here are the mistakes you should avoid.

1. Trusting X-Forwarded-For without verifying the proxy

This is the most common mistake.

The X-Forwarded-For header is just another HTTP request header. If your application is directly accessible from the internet, a visitor can send any value they want.

Never use this code:

<?php

$clientIp = $_SERVER['HTTP_X_FORWARDED_FOR'];

Instead, read this header only after confirming that REMOTE_ADDR belongs to one of your trusted proxies.

2. Ignoring IPv6 addresses

Modern web servers may receive either IPv4 or IPv6 connections. Always validate the IP address instead of assuming it is IPv4.

<?php

if (filter_var($ipAddress, FILTER_VALIDATE_IP) !== false) {
    echo "Valid IP address";
}

FILTER_VALIDATE_IP supports both IPv4 and IPv6.

3. Assuming localhost always uses 127.0.0.1

When running PHP locally, you may see either of these values:

• 127.0.0.1 (IPv4)
• ::1 (IPv6 localhost)

Both are valid localhost addresses.

4. Storing the IP address in a column that is too small

An IPv6 address is much longer than an IPv4 address.

If you save IP addresses in a database, use a column large enough for both formats.

A common choice is:

VARCHAR(45)

This accommodates both IPv4 and IPv6 addresses.

Security considerations

• Do not trust X-Forwarded-For or similar headers unless the request came through a trusted reverse proxy.
• Always validate the detected IP address with filter_var() before using or storing it.
• Support both IPv4 and IPv6 addresses instead of assuming IPv4.
• If you store IP addresses in a database, use a column large enough for IPv6, such as VARCHAR(45).
• A client IP address should not be used as the sole authentication or authorization mechanism because users may share IP addresses or access your application through VPNs, proxies, or mobile networks.

Frequently asked questions

Does REMOTE_ADDR always contain the client’s IP?

No. If your application is behind a reverse proxy, CDN, or load balancer, REMOTE_ADDR usually contains the address of that intermediate server.

Can a user fake X-Forwarded-For?

Yes. A client can send any value unless the request passes through a trusted proxy that overwrites the header before forwarding the request.

Can PHP detect a user’s exact location from the IP address?

No. An IP address only identifies the network connection. If you need approximate geographic information, use an IP geolocation service. Keep in mind that VPNs, mobile networks, and corporate gateways can affect the reported location.

Why do I see different IP addresses during development?

If you use Docker, WAMP, XAMPP, Nginx Proxy Manager, Cloudflare Tunnel, or another proxy, your request may pass through additional network layers before reaching PHP. In these cases, configure your trusted proxies correctly instead of relying solely on REMOTE_ADDR.

Conclusion

For most PHP applications, getting the client IP address is as simple as reading $_SERVER['REMOTE_ADDR']. This is the correct and safest approach when your web server receives requests directly from visitors.

If your application is behind a reverse proxy, load balancer, or CDN, the process requires one additional step. First, verify that REMOTE_ADDR belongs to a trusted proxy. Only then should you read the forwarding header configured by that proxy.

By validating the IP address and trusting forwarded headers only from known infrastructure, you can avoid spoofed values while supporting modern deployment environments.

Download the source code

Download the complete example project used in this tutorial to see a production-friendly implementation of client IP detection in PHP.

Download PHP Client IP Address Source Code

The project includes:

• A reusable ClientIpResolver class.
• A configurable trusted proxy list.
• Support for IPv4 and IPv6 validation.
• A clean demo page to display the detected client IP address.
• Step-by-step setup instructions.