X-Forwarded-Forthe header is not part of the RFC, therefore, differs in the implementation of proxies. You should not rely on this value because it may be tampered with or just not sent a proxy.
If this is important, and you can afford to do this, you must force requests through HTTPS and search REMOTE_ADDR.
source
share