How to Get the Client IP Address in PHP

By the end of this page, you will understand how PHP exposes a visitor's IP address, the difference between REMOTE_ADDR and proxy-related headers, and how to safely store IP information for login records.

When a user visits a PHP application, the web server provides request information through the $_SERVER superglobal. One of the most common values is:

$_SERVER['REMOTE_ADDR']

This usually contains the IP address of the client directly connected to your server.

That sounds simple, but in real applications there is an important detail: the "client" connected to your server may not always be the actual end user.

For example:

• A reverse proxy may sit in front of your app
• A load balancer may forward the request
• A CDN such as Cloudflare may pass traffic through its own network
• A corporate network may route many users through shared infrastructure

Because of this, getting the "real" client IP can mean different things depending on your deployment.

The basic source: REMOTE_ADDR

In a standard setup, the safest default is:

$ip = $_SERVER['REMOTE_ADDR'] ?? null;

This gives you the IP address that your server sees as the source of the request.

Why not trust every header?

You may also see examples using headers such as:

• HTTP_X_FORWARDED_FOR
• HTTP_CLIENT_IP
• HTTP_CF_CONNECTING_IP

These can be useful only when your infrastructure is configured to trust them. Otherwise, a user can sometimes spoof them by sending fake headers.

That means:

• REMOTE_ADDR is the safest general default
• forwarded headers should be used only if you control and trust the proxy chain

Why this matters

IP addresses are commonly used for:

• login auditing
• suspicious activity detection
• rate limiting
• fraud analysis
• security logs

But an IP address is not a reliable user identity by itself. Multiple users can share one IP, and one user can appear from different IPs over time.

Think of a request like a letter being delivered to your office.

• REMOTE_ADDR is the address of the person who handed the letter to your receptionist.
• If that person is a trusted courier, they may include a note saying who originally sent it.
• Headers like X-Forwarded-For are that note.

If you do not trust the courier, you should not trust the note.

So the rule is:

• No trusted proxy setup -> use REMOTE_ADDR
• Trusted proxy setup -> read the forwarded header your proxy provides

Basic syntax

$ip = $_SERVER['REMOTE_ADDR'] ?? 'IP not available';

This reads the client IP from the server data and uses a fallback value if it is missing.

Simple example: log IP at login

<?php
session_start();

$username = $_POST['username'] ?? '';
$password = $_POST['password'] ?? '';

// Example only: replace with real authentication
if ($username === 'admin' && $password === 'secret') {
    $ip = $_SERVER['REMOTE_ADDR'] ?? 'unknown';

    echo "Login successful from IP: " . $ip;
} else {
    echo "Invalid credentials.";
}

What this does

• Reads submitted login data
• Checks the credentials
• If login succeeds, reads the request IP
• Stores or displays that IP

Consider this example:

<?php
function getClientIp(): ?string
{
    $ip = $_SERVER['REMOTE_ADDR'] ?? null;

    if ($ip !== null && filter_var($ip, FILTER_VALIDATE_IP)) {
        return $ip;
    }

    return null;
}

$ip = getClientIp();

echo $ip ?? 'No valid IP found';

Step by step

1. PHP starts executing the script.

2. The function getClientIp() is defined.

3. The line below runs:

   $ip = getClientIp();
   

4. Inside the function, PHP reads:

   $_SERVER[] ?? 
   

Common use cases

Login history

Store the IP address each time a user signs in.

Example uses:

• show "last login IP" in the account page
• detect unusual login locations
• help users confirm account activity

Security auditing

Record IPs for important account actions such as:

• password changes
• failed login attempts
• enabling two-factor authentication

Rate limiting

Track repeated requests from the same IP to reduce abuse.

Examples:

• limit login attempts
• limit API calls
• slow down bots or scrapers

Fraud and abuse detection

IPs can be part of a larger signal set.

Examples:

• too many accounts created from one IP
• suspicious checkout activity
• repeated failed payment attempts

Analytics and diagnostics

Developers sometimes use IP logs to:

• investigate traffic spikes
• debug infrastructure issues
• understand proxy behavior

Important limitation

An IP address should be treated as supporting metadata, not as proof of identity.

In real projects, developers usually do more than just read $_SERVER['REMOTE_ADDR'] directly in every file.

Common patterns

Wrap IP detection in a function or service

function getClientIp(): ?string
{
    $ip = $_SERVER['REMOTE_ADDR'] ?? null;
    return filter_var($ip, FILTER_VALIDATE_IP) ? $ip : null;
}

This keeps the logic in one place.

Save IP during authentication events

Typical flow:

1. User submits credentials
2. App verifies them
3. App logs the event with timestamp and IP
4. App creates the session

Use guard clauses

$ip = $_SERVER['REMOTE_ADDR'] ?? null;
if (!$ip || !filter_var($ip, FILTER_VALIDATE_IP)) {
    $ip = 'unknown';
}

This avoids using bad data later.

1. Trusting HTTP_X_FORWARDED_FOR without a trusted proxy

Broken example:

$ip = $_SERVER['HTTP_X_FORWARDED_FOR'];

Problem:

• This header may be missing
• It may contain multiple IPs
• It may be user-controlled in some setups

Better:

$ip = $_SERVER['REMOTE_ADDR'] ?? null;

Use forwarded headers only if your infrastructure is configured to trust them.

2. Assuming the IP always identifies one person

One IP can represent:

• a whole office
• a mobile carrier network
• a family on one router
• a public Wi-Fi network

Avoid using IP as the only identity check.

3. Not validating the value

Broken example:

$ip = $_SERVER['REMOTE_ADDR'];

This may work, but validation is better before storing or processing.

Better:

 = [] ?? ;
 (!(, FILTER_VALIDATE_IP)) {
     = ;
}

Common sources of client IP information

vs forwarded headers

Quick reference

Get client IP

$ip = $_SERVER['REMOTE_ADDR'] ?? null;

Validate IP

if ($ip !== null && filter_var($ip, FILTER_VALIDATE_IP)) {
    // valid IP
}

Simple helper

function getClientIp(): ?string
{
    $ip = $_SERVER['REMOTE_ADDR'] ?? null;
    return filter_var($ip, FILTER_VALIDATE_IP) ? $ip : null;
}

Best default rule

• Use REMOTE_ADDR unless you have a trusted proxy setup.

Be careful with these

• HTTP_X_FORWARDED_FOR

How do I get the client IP address in PHP?

Use:

$ip = $_SERVER['REMOTE_ADDR'] ?? null;

This is the most common and safest default.

Is REMOTE_ADDR always the real user IP?

No. If your app is behind a reverse proxy, CDN, or load balancer, REMOTE_ADDR may be the proxy's IP instead.

Should I use HTTP_X_FORWARDED_FOR in PHP?

Only if your infrastructure is configured to trust that header. Otherwise it may be spoofed or contain unexpected values.

Can multiple users have the same IP address?

Yes. Users behind the same router, office network, or mobile carrier may share one public IP.

Can one user have different IP addresses?

Yes. Mobile networks, VPNs, home internet changes, and switching networks can all change a user's IP.

How should I store login IP addresses?

Store them as audit data alongside the user ID and timestamp. Do not rely on IP alone for authentication.

Does PHP support IPv6 addresses too?

Yes. FILTER_VALIDATE_IP can validate both IPv4 and IPv6 addresses.

What if REMOTE_ADDR is missing?

Use a fallback like or and handle that case safely in your code.

Related concepts

• $_SERVER superglobal — The PHP array that contains request and server information.
• HTTP headers — Important for understanding forwarded IP headers and proxy behavior.
• Input validation — Useful for checking whether an IP address is well formed.
• PHP sessions — Often used together with login tracking and user activity.
• Authentication in PHP — IP logging is commonly added during login flows.
• Audit logging — The broader practice of recording security-relevant events.
• Reverse proxies — Important when the IP seen by your app is not the original client IP.
• Rate limiting — Frequently uses IP addresses as one signal for controlling request volume.