activitypub_client_ip_sources

Filter the ordered list of $_SERVER keys to consult as a source for the client IP. The first key whose value parses as a valid IP wins.

Default: array( 'REMOTE_ADDR' ) — the actual TCP peer, the only value that an HTTP client cannot spoof. Trusting any other $_SERVER key is only safe when a reverse proxy in front of the site sets that key and overwrites any client-supplied version; otherwise an attacker can spoof the value and bypass the per-IP rate limits that depend on it.

Common operator overrides: array( 'HTTP_CF_CONNECTING_IP' ) on Cloudflare. array( 'HTTP_TRUE_CLIENT_IP', 'REMOTE_ADDR' ) Akamai with a fallback. array( 'HTTP_X_REAL_IP' ) nginx that strips the client copy.

X-Forwarded-For pitfall: even with a trusted proxy, an attacker can prepend their own value before the proxy appends the real client IP. This helper takes the leftmost entry, which is correct only when the trusted proxy fully overwrites the header. If you trust X-Forwarded-For end-to-end, prefer to resolve from the right by your known proxy count via the activitypub_client_ip filter.

Auto-generated Example

/**
 * Filter the ordered list of $_SERVER keys to consult as a source for the
 * client IP. The first key whose value parses as a valid IP wins.
 * 
 * Default: array( 'REMOTE_ADDR' ) — the actual TCP peer, the only value
 * that an HTTP client cannot spoof. Trusting any other $_SERVER key is
 * only safe when a reverse proxy in front of the site sets that key and
 * overwrites any client-supplied version; otherwise an attacker can spoof
 * the value and bypass the per-IP rate limits that depend on it.
 * 
 * Common operator overrides:
 * array( 'HTTP_CF_CONNECTING_IP' )                      on Cloudflare.
 * array( 'HTTP_TRUE_CLIENT_IP', 'REMOTE_ADDR' )         Akamai with a fallback.
 * array( 'HTTP_X_REAL_IP' )                             nginx that strips the client copy.
 * 
 * X-Forwarded-For pitfall: even with a trusted proxy, an attacker can
 * prepend their own value before the proxy appends the real client IP.
 * This helper takes the leftmost entry, which is correct only when the
 * trusted proxy fully overwrites the header. If you trust X-Forwarded-For
 * end-to-end, prefer to resolve from the right by your known proxy count
 * via the activitypub_client_ip filter.
 *
 * @param Activitypub\string[] $sources 
 * @return Activitypub\string[] The filtered value.
 */
function my_activitypub_client_ip_sources_callback( Activitypub\string[] $sources ) {
    // Your code here.
    return $sources;
}
add_filter( 'activitypub_client_ip_sources', 'my_activitypub_client_ip_sources_callback' );

Parameters

• Activitypub\string[] $sources $_SERVER keys to consult, in priority order.

Files

• includes/functions.php:419

\apply_filters( 'activitypub_client_ip_sources', array( 'REMOTE_ADDR' ) )

← All Hooks