Harwinder Sekhon
eb93303c09
Behind a proxy REMOTE_ADDR is the proxy, so the per-IP limit would lump every visitor together. New optional CLIENT_IP_HEADER in config.php (e.g. 'CF-Connecting-IP') tells the throttle which header carries the real address; invalid or absent values fall back to REMOTE_ADDR, and configs that predate the setting behave as before. Only for origins unreachable except through the proxy — documented in the README, which also covers the mod_remoteip/real_ip alternative. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SePf61iazhCLJBefdRLBDm