Behind a reverse proxy: the real IP of your users

1Why it matters

curl -H 'X-Forwarded-For: 10.0.0.1' https://example.com/admin/

2Your setup

3How a request goes through

4Configuration

5Check it

Add a temporary ip.php file to your application, then call it from your computer:

<?php echo $_SERVER['REMOTE_ADDR'], ' ', $_SERVER['HTTPS'] ?? 'off';

The access log of Apache (docker compose logs app, see Logs) shows the same addresses. Remove ip.php afterwards.

6What the container does

7Why not the trusted proxies of Symfony or Laravel

• They only fix PHP: the access log of Apache, Require ip and the other Apache rules keep the IP of the proxy.
• Their usual configuration trusts too much: TRUSTED_PROXIES=REMOTE_ADDR (Symfony) or trustProxies(at: '*') (Laravel) trusts whoever connects. It is safe only as long as the container can never be reached without the proxy: one published port or one shared network, and anyone chooses their IP. Listing the real proxies instead means following the IPs of the containers and the ranges of Cloudflare, in each application.
• Each application must do it, and WordPress or an older application has no such setting.

With APACHE_TRUSTED_PROXIES, REMOTE_ADDR and HTTPS are already right: leave the trusted proxies of the framework empty. Keeping both would be worse than either one: the framework would take the client for a proxy and read the rest of X-Forwarded-For, written by the client.

8Logs

The access log and the error log of Apache show the client IP found by the container. Four variables set them, chosen in Your setup:

docker compose logs -f app          # everything
docker logs app 2>/dev/null          # the access log only
kubectl logs -f deploy/app           # on Kubernetes

    logging:
      driver: local      # compressed, 5 files of 20 MB by default
      options:
        max-size: 50m
        max-file: "5"

/var/log/apache2/access.2026-11-13.log
/var/log/apache2/access.2026-11-12.log.gz
/var/log/apache2/error.2026-11-13.log

docker compose exec app tail -f /var/log/apache2/access.$(date -u +%F).log
docker compose exec app zgrep ' 500 ' /var/log/apache2/access.*.log.gz

9Fine-tuning and custom setups

APACHE_TRUSTED_PROXIES lists the proxies whose X-Forwarded-For hop is trusted, separated by spaces or commas. APACHE_TRUSTED_CLOUDFLARE=1 adds Cloudflare:

The configuration they generate is a good starting point:

docker compose exec app cat /etc/apache2/conf-enabled/docker-trusted-proxies.conf

Your own mod_remoteip configuration

These variables are a shortcut, not a replacement for mod_remoteip. For another header, the PROXY protocol or a list of proxies managed elsewhere, leave them empty, enable the modules and mount your own file:

services:
  app:
    environment:
      APACHE_EXTENSIONS: remoteip headers
    volumes:
      - ./remoteip.conf:/etc/apache2/conf-enabled/remoteip.conf:ro

# remoteip.conf
#
# The header that carries the client IP. X-Forwarded-For is a list ("client, proxy 1, proxy 2"): Apache reads it from
# the right and stops at the first address that is not a trusted proxy. A header with a single address (X-Real-IP,
# True-Client-IP) is only used when the request comes from a trusted proxy.
RemoteIPHeader X-Real-IP

# Proxies of your network: IPs, CIDR ranges, or host names (resolved once, when Apache starts: prefer the variables
# above for containers whose IP changes)
RemoteIPInternalProxy 10.0.0.0/16

# Proxies on the internet (a CDN): same, but a private address they forward is not accepted as the client IP
RemoteIPTrustedProxy 203.0.113.0/24

# Or a file of addresses, one per line, that you keep up to date (reloaded with apache2ctl graceful)
#RemoteIPTrustedProxyList /etc/apache2/cdn-ips.txt

# PROXY protocol (HAProxy, AWS NLB): the address comes from the connection itself, no header is used. Every
# connection must then use it, except the ones of the listed addresses (the health checks of Docker for instance).
#RemoteIPProxyProtocol On
#RemoteIPProxyProtocolExceptions 127.0.0.1

# HTTPS=on for PHP, only when the request comes from the proxy: a SetEnvIf on X-Forwarded-Proto alone would let any
# client set it
<If "%{HTTP:X-Forwarded-Proto} == 'https' && %{CONN_REMOTE_ADDR} -ipmatch '10.0.0.0/16'">
    SetEnv HTTPS on
</If>

Check it with docker compose exec app apache2ctl configtest, then with ip.php (Check it). headers is only needed for RequestHeader directives.

The fpm variant behind your own nginx

Without its built-in Apache, PHP-FPM receives the client IP from nginx: use its real IP module (set_real_ip_from with the address of the proxy in front of it, real_ip_header X-Forwarded-For, real_ip_recursive on).