How to Get the Client IP Address in PHP

By the end of this page, you will understand how PHP exposes a visitor's IP address, the difference between REMOTE_ADDR and proxy-related headers, and how to safely store IP information for login records.

When a user visits a PHP application, the web server provides request information through the $_SERVER superglobal. One of the most common values is:

$_SERVER['REMOTE_ADDR']

This usually contains the IP address of the client directly connected to your server.

That sounds simple, but in real applications there is an important detail: the "client" connected to your server may not always be the actual end user.

For example:

• A reverse proxy may sit in front of your app
• A load balancer may forward the request
• A CDN such as Cloudflare may pass traffic through its own network
• A corporate network may route many users through shared infrastructure

Because of this, getting the "real" client IP can mean different things depending on your deployment.

The basic source: REMOTE_ADDR

In a standard setup, the safest default is:

$ip = $_SERVER['REMOTE_ADDR'] ?? null;

This gives you the IP address that your server sees as the source of the request.

Why not trust every header?

You may also see examples using headers such as:

• HTTP_X_FORWARDED_FOR
• HTTP_CLIENT_IP
• HTTP_CF_CONNECTING_IP

These can be useful only when your infrastructure is configured to trust them. Otherwise, a user can sometimes spoof them by sending fake headers.

That means:

• REMOTE_ADDR is the safest general default
• forwarded headers should be used only if you control and trust the proxy chain

Why this matters

IP addresses are commonly used for:

• login auditing
• suspicious activity detection
• rate limiting
• fraud analysis
• security logs

But an IP address is not a reliable user identity by itself. Multiple users can share one IP, and one user can appear from different IPs over time.

Think of a request like a letter being delivered to your office.

• REMOTE_ADDR is the address of the person who handed the letter to your receptionist.
• If that person is a trusted courier, they may include a note saying who originally sent it.
• Headers like X-Forwarded-For are that note.

If you do not trust the courier, you should not trust the note.

So the rule is:

• No trusted proxy setup -> use REMOTE_ADDR
• Trusted proxy setup -> read the forwarded header your proxy provides

Basic syntax

$ip = $_SERVER['REMOTE_ADDR'] ?? 'IP not available';

This reads the client IP from the server data and uses a fallback value if it is missing.

Simple example: log IP at login

<?php
session_start();

$username = $_POST['username'] ?? '';
$password = $_POST['password'] ?? '';

// Example only: replace with real authentication
if ($username === 'admin' && $password === 'secret') {
    $ip = $_SERVER['REMOTE_ADDR'] ?? 'unknown';

    echo "Login successful from IP: " . $ip;
} else {
    echo "Invalid credentials.";
}

What this does

• Reads submitted login data
• Checks the credentials
• If login succeeds, reads the request IP
• Stores or displays that IP

Slightly safer helper function

<?php
function getClientIp(): ?string
{
    return $_SERVER['REMOTE_ADDR'] ?? null;
}

$ip = getClientIp();

This is useful because you can later update the function if your infrastructure changes.

Example with validation

<?php
function getClientIp(): ?string
{
    $ip = $_SERVER['REMOTE_ADDR'] ?? null;

    if ($ip !== null && filter_var($ip, FILTER_VALIDATE_IP)) {
        return $ip;
    }

    return null;
}

This validates that the value is a properly formatted IP address before using it.

Consider this example:

<?php
function getClientIp(): ?string
{
    $ip = $_SERVER['REMOTE_ADDR'] ?? null;

    if ($ip !== null && filter_var($ip, FILTER_VALIDATE_IP)) {
        return $ip;
    }

    return null;
}

$ip = getClientIp();

echo $ip ?? 'No valid IP found';

Step by step

1. PHP starts executing the script.

2. The function getClientIp() is defined.

3. The line below runs:

   $ip = getClientIp();
   

4. Inside the function, PHP reads:

   $_SERVER['REMOTE_ADDR'] ?? null
   

   • If REMOTE_ADDR exists, $ip gets that value.
   • If it does not exist, $ip becomes null.

5. Then PHP checks:

   $ip !== null && filter_var($ip, FILTER_VALIDATE_IP)
   

   • Is there a value?
   • Is it a valid IPv4 or IPv6 address?

6. If both checks pass, the function returns the IP.

7. Otherwise, it returns null.

8. Finally, PHP prints either the IP address or the text No valid IP found.

Example trace

If:

$_SERVER['REMOTE_ADDR'] = '203.0.113.42';

Then the output is:

203.0.113.42

If the value is missing or invalid, the output is:

No valid IP found

Common use cases

Login history

Store the IP address each time a user signs in.

Example uses:

• show "last login IP" in the account page
• detect unusual login locations
• help users confirm account activity

Security auditing

Record IPs for important account actions such as:

• password changes
• failed login attempts
• enabling two-factor authentication

Rate limiting

Track repeated requests from the same IP to reduce abuse.

Examples:

• limit login attempts
• limit API calls
• slow down bots or scrapers

Fraud and abuse detection

IPs can be part of a larger signal set.

Examples:

• too many accounts created from one IP
• suspicious checkout activity
• repeated failed payment attempts

Analytics and diagnostics

Developers sometimes use IP logs to:

• investigate traffic spikes
• debug infrastructure issues
• understand proxy behavior

Important limitation

An IP address should be treated as supporting metadata, not as proof of identity.

In real projects, developers usually do more than just read $_SERVER['REMOTE_ADDR'] directly in every file.

Common patterns

Wrap IP detection in a function or service

function getClientIp(): ?string
{
    $ip = $_SERVER['REMOTE_ADDR'] ?? null;
    return filter_var($ip, FILTER_VALIDATE_IP) ? $ip : null;
}

This keeps the logic in one place.

Save IP during authentication events

Typical flow:

1. User submits credentials
2. App verifies them
3. App logs the event with timestamp and IP
4. App creates the session

Use guard clauses

$ip = $_SERVER['REMOTE_ADDR'] ?? null;
if (!$ip || !filter_var($ip, FILTER_VALIDATE_IP)) {
    $ip = 'unknown';
}

This avoids using bad data later.

Store IP with related audit data

Developers often save:

• user ID
• event type
• IP address
• user agent
• timestamp

Handle trusted proxies centrally

If an app is behind Nginx, Apache proxying, a load balancer, or Cloudflare, teams often configure the app or framework to trust specific proxy headers rather than manually reading random headers in many places.

Database example

<?php
$ip = $_SERVER['REMOTE_ADDR'] ?? null;

$stmt = $pdo->prepare(
    'INSERT INTO login_audit (user_id, ip_address, logged_in_at) VALUES (:user_id, :ip, NOW())'
);

$stmt->execute([
    'user_id' => $userId,
    'ip' => $ip,
]);

This is the kind of code commonly used after a successful login.

1. Trusting HTTP_X_FORWARDED_FOR without a trusted proxy

Broken example:

$ip = $_SERVER['HTTP_X_FORWARDED_FOR'];

Problem:

• This header may be missing
• It may contain multiple IPs
• It may be user-controlled in some setups

Better:

$ip = $_SERVER['REMOTE_ADDR'] ?? null;

Use forwarded headers only if your infrastructure is configured to trust them.

2. Assuming the IP always identifies one person

One IP can represent:

• a whole office
• a mobile carrier network
• a family on one router
• a public Wi-Fi network

Avoid using IP as the only identity check.

3. Not validating the value

Broken example:

$ip = $_SERVER['REMOTE_ADDR'];

This may work, but validation is better before storing or processing.

Better:

$ip = $_SERVER['REMOTE_ADDR'] ?? null;
if (!filter_var($ip, FILTER_VALIDATE_IP)) {
    $ip = null;
}

4. Ignoring IPv6

Some developers assume IPs always look like 192.168.1.10.

But valid addresses can also be IPv6, such as:

2001:db8::1

Use FILTER_VALIDATE_IP so both formats are handled.

5. Using IP for security decisions by itself

Bad idea:

• "If the IP matches, it must be the same user"

Better:

• combine IP with session checks, authentication, device info, and account history

6. Failing when the server key is missing

Broken example:

$ip = $_SERVER['REMOTE_ADDR'];

This can raise notices in some environments.

Better:

$ip = $_SERVER['REMOTE_ADDR'] ?? 'unknown';

Common sources of client IP information

REMOTE_ADDR vs forwarded headers

Logging IP vs identifying a user

Quick reference

Get client IP

$ip = $_SERVER['REMOTE_ADDR'] ?? null;

Validate IP

if ($ip !== null && filter_var($ip, FILTER_VALIDATE_IP)) {
    // valid IP
}

Simple helper

function getClientIp(): ?string
{
    $ip = $_SERVER['REMOTE_ADDR'] ?? null;
    return filter_var($ip, FILTER_VALIDATE_IP) ? $ip : null;
}

Best default rule

• Use REMOTE_ADDR unless you have a trusted proxy setup.

Be careful with these

• HTTP_X_FORWARDED_FOR
• HTTP_CLIENT_IP
• other custom forwarding headers

Why be careful?

• headers can be missing
• headers can be spoofed
• some headers contain multiple IPs

Important reminders

• IP is not a unique identity
• support both IPv4 and IPv6
• validate before storing
• log IP as metadata, not proof of user identity

How do I get the client IP address in PHP?

Use:

$ip = $_SERVER['REMOTE_ADDR'] ?? null;

This is the most common and safest default.

Is REMOTE_ADDR always the real user IP?

No. If your app is behind a reverse proxy, CDN, or load balancer, REMOTE_ADDR may be the proxy's IP instead.

Should I use HTTP_X_FORWARDED_FOR in PHP?

Only if your infrastructure is configured to trust that header. Otherwise it may be spoofed or contain unexpected values.

Can multiple users have the same IP address?

Yes. Users behind the same router, office network, or mobile carrier may share one public IP.

Can one user have different IP addresses?

Yes. Mobile networks, VPNs, home internet changes, and switching networks can all change a user's IP.

How should I store login IP addresses?

Store them as audit data alongside the user ID and timestamp. Do not rely on IP alone for authentication.

Does PHP support IPv6 addresses too?

Yes. FILTER_VALIDATE_IP can validate both IPv4 and IPv6 addresses.

What if REMOTE_ADDR is missing?

Use a fallback like null or 'unknown' and handle that case safely in your code.

Related concepts

• $_SERVER superglobal — The PHP array that contains request and server information.
• HTTP headers — Important for understanding forwarded IP headers and proxy behavior.
• Input validation — Useful for checking whether an IP address is well formed.
• PHP sessions — Often used together with login tracking and user activity.
• Authentication in PHP — IP logging is commonly added during login flows.
• Audit logging — The broader practice of recording security-relevant events.
• Reverse proxies — Important when the IP seen by your app is not the original client IP.
• Rate limiting — Frequently uses IP addresses as one signal for controlling request volume.