Get a user’s IP address with PHP — the most accurate way.

Savvy or extra cautious visitors can easily spoof their IP address. This can make getting accurate geolocation or user tracking data difficult. There’s not a 100% way of ensuring an IP address is accurate, but there is a 99.9% way. It will not protect you from the 0.1% of malicious users looking to abuse your system by injecting their own request headers.

tl;dr

<?php
/**
 * Return the current visitor's IP address.
 * 
 * @since x.x.x
 * @link https://www.benmarshall.me/get-ip-address/
 * 
 * @return string|false The current visitor's IP address, false if unavailable.
 */
if ( ! function_exists( 'get_ip_address' ) ) {
  function get_ip_address() {
    foreach([
      'HTTP_CLIENT_IP', 
      'HTTP_X_FORWARDED_FOR', 
      'HTTP_X_FORWARDED', 
      'HTTP_X_CLUSTER_CLIENT_IP', 
      'HTTP_FORWARDED_FOR', 
      'HTTP_FORWARDED', 
      'REMOTE_ADDR'
    ] as $key ) {
      if ( array_key_exists( $key, $_SERVER ) === true ) {
        foreach( explode( ',', $_SERVER[ $key ] ) as $ip_address ) {
          $ip_address = trim( $ip_address );
          if ( filter_var( 
            $ip_address, 
            FILTER_VALIDATE_IP, 
            FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) !== false 
          ) {
            return $ip_address;
          }
        }
      }
    }
  }
}

When the client connects to a web server the IP address gets assigned by using one of the HTTP headers. RFC 7239 standard specifies the Forwarded headers. Many proxy servers and caching engines use also nonstandard but adopted by practice the X-Forwarded-For HTTP header field to assign a comma and space-separated values of IP addresses (first one is the originating client).

Get a User’s IP Address with PHP — the most accurate way.

Once an IP address is retrieved from one of the variables above, it cleans and verifies before returning it. Just remember, there’s no guarantee that it’s going to be 100% accurate, but 99.9% is just as good. And why not just use REMOTE_ADDR?

REMOTE_ADDR and why it’s not perfect.

Using REMOTE_ADDR is the simplest way to get a visitor’s IP address, however, sometimes it’s not correct. There’s a number of reasons why:

• The user is behind a proxy
• Your apache server is behind a reverse proxy (e.g. varnish)

REMOTE_ADDR will work, but using the function above is ideal if you want to be super cautious about getting the most accurate IP address — and why wouldn’t you want to. Gathering IP data for tracking or site protection should always be as accurate as possible.

Frequently Asked Questions