Title: Patch to support nginx reverse proxy
Last modified: April 25, 2023

---

# Patch to support nginx reverse proxy

 *  Resolved [dbrosemer](https://wordpress.org/support/users/dbrosemer/)
 * (@dbrosemer)
 * [3 years, 1 month ago](https://wordpress.org/support/topic/patch-to-support-nginx-reverse-proxy/)
 * Hi, team. I run WordPress behind an nginx reverse proxy and login-lockdown blocks
   the proxy’s IP. I’d suggest this patch. Can it be incorporated?
 * Thanks!
 *     ```wp-block-code
       --- wp-content/plugins/login-lockdown/libs/utility.php.orig
       +++ wp-content/plugins/login-lockdown/libs/utility.php
       @@ -129,7 +129,9 @@
          {
            $ip = '';
   
       -    if (!empty($_SERVER['REMOTE_ADDR'])) {
       +    if(isset($_SERVER['HTTP_X_FORWARDED_FOR']) && !empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
       +        $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
       +    } elseif (!empty($_SERVER['REMOTE_ADDR'])) {
              $ip = $_SERVER['REMOTE_ADDR'];
            }
       ```
   

Viewing 1 replies (of 1 total)

 *  Plugin Author [Alexandru Tapuleasa](https://wordpress.org/support/users/talextech/)
 * (@talextech)
 * [3 years, 1 month ago](https://wordpress.org/support/topic/patch-to-support-nginx-reverse-proxy/#post-16687079)
 * Hi,
 * HTTP_X_FORWARDED_FOR is just a header that anyone can just set to whatever they
   want when making the request. So anyone trying to bruteforce your login can just
   randomly set a different IP on each request.
 * You need to properly configure nginx to send the real IP to apache. You can search
   online for “nginx apache mod_remoteip” to get more info. Or if you have a managed
   server just ask your host to do it for you 🙂

Viewing 1 replies (of 1 total)

The topic ‘Patch to support nginx reverse proxy’ is closed to new replies.

 * ![](https://ps.w.org/login-lockdown/assets/icon-256x256.png?rev=2901919)
 * [Login Lockdown & Protection](https://wordpress.org/plugins/login-lockdown/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/login-lockdown/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/login-lockdown/)
 * [Active Topics](https://wordpress.org/support/plugin/login-lockdown/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/login-lockdown/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/login-lockdown/reviews/)

 * 1 reply
 * 2 participants
 * Last reply from: [Alexandru Tapuleasa](https://wordpress.org/support/users/talextech/)
 * Last activity: [3 years, 1 month ago](https://wordpress.org/support/topic/patch-to-support-nginx-reverse-proxy/#post-16687079)
 * Status: resolved