I am using a shortcode in Wordpress to capture the visitor's IP address. This is working except for one thing. For one visitor, two IP addresses separated by a comma was captured with the shortcode below. The 2nd IP doesn't seem to exist with nslookup. I have added my fix to grab the first IP, but I would love to know how this is possible.

obfuscated "24.158.999.999, 104.129.999.999"

 function get_visitor_ip() {
    if (!empty( $_SERVER['HTTP_CLIENT_IP'])) {
    //check ip from internet
    $ip = $_SERVER['HTTP_CLIENT_IP'];
    } elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
    //to check ip is pass from proxy
    $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
    } else {
    $ip = $_SERVER['REMOTE_ADDR'];
    }
    return apply_filters('wpb_get_ip', $ip);
 }
 add_shortcode('visitor_ip', 'get_visitor_ip');

I am using a shortcode in Wordpress to capture the visitor's IP address. This is working except for one thing. For one visitor, two IP addresses separated by a comma was captured with the shortcode below. The 2nd IP doesn't seem to exist with nslookup. I have added my fix to grab the first IP, but I would love to know how this is possible.

obfuscated "24.158.999.999, 104.129.999.999"

 function get_visitor_ip() {
    if (!empty( $_SERVER['HTTP_CLIENT_IP'])) {
    //check ip from internet
    $ip = $_SERVER['HTTP_CLIENT_IP'];
    } elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
    //to check ip is pass from proxy
    $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
    } else {
    $ip = $_SERVER['REMOTE_ADDR'];
    }
    return apply_filters('wpb_get_ip', $ip);
 }
 add_shortcode('visitor_ip', 'get_visitor_ip');

• plugin-development

• 1 I'd guess you had two X-Forwarded-For headers from two layers of proxies, but I've never seen that myself. – Rup Commented Feb 1, 2021 at 10:56

1 Answer 1

See the accepted answer at ServerFault:

[...] if a request is chained through more than one proxy server, then each proxy should add the IP of the preceding one to the existing X-Forwarded-For header so that the entire chain is preserved.

X-Forwarded-For: <client>, <proxy1>, <proxy2>, ...