(adsbygoogle = window.adsbygoogle || []).push({}); This php code I wrote is a way to securely restore the IP Address of the visitor on the page when using CloudFlare.

What is different?
It verifies that the REMOTE_ADDR is a CloudFlare IP. If it isn't we will consider the request invalid and just die the page.
In some instances not verifying the REMOTE_ADDR and reverting the IP Address without validation creates
a security risk. I'm not going to go in great depth about it considering this thread is about the script.

How to use?
Just include it on top of every PHP file by using include, include_once, require, or require_once.

Updating CloudFlare's IP's
You have to make sure the IPV4's and IPV6's of CloudFlares are up to date.

If you experience any problems with this script just tell me.

    

<?php



define('CLOUDFLARE_ENABLED', true); // Update this if you have turned off CloudFlare or plan to



// Check if admin/owner has enabled

// cloudflare.

if (defined('CLOUDFLARE_ENABLED' && CLOUDFLARE_ENABLED == true &&

	isset($_SERVER['HTTP_CF_CONNECTING_IP']))

{

	// CloudFlare's IPV4s

	// See the list at https://cloudflare.com/ips-v4

	$ipv4s = array(

	'103.21.244.0/22',

	'103.22.200.0/22',

	'103.31.4.0/22',

	'104.16.0.0/12',

	'108.162.192.0/18',

	'131.0.72.0/22',

	'141.101.64.0/18',

	'162.158.0.0/15',

	'172.64.0.0/13',

	'173.245.48.0/20',

	'188.114.96.0/20',

	'190.93.240.0/20',

	'197.234.240.0/22',

	'198.41.128.0/17',

	'199.27.128.0/21'

	);

	

	// CloudFlare's IPV6s

	// See the list at https://cloudflare.com/ips-v4

	$ipv6s = array(

	'2400:cb00::/32',

	'2405:8100::/32',

	'2405:b500::/32',

	'2406:4700::/32',

	'2803:f800::/32'

	);

	

	$invalid = true;

	

	if (!filter_var($_SERVER['REMOTE_ADDR'], FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) === false) {

		foreach ($ipv4s as $ip_range) {

			if (ipv4_in_range($_SERVER['REMOTE_ADDR'], $ip_range)) {

				$invalid = false;

				break;

			}

		}

	} else if (!filter_var($_SERVER['REMOTE_ADDR'], FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) === false) {

		foreach ($ipv6s as $ip_range) {

			if (ipv6_in_range($_SERVER['REMOTE_ADDR'], $ip_range)) {

				$invalid = false;

				break;

			}

		}

	}

	

	if ($invalid == false) {

		$_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_CF_CONNECTING_IP'];

	} else {

		die('Faking CloudFlare header\'s.';

	}

}



/**

 * Checks if given IPV4 is in the IPV4 Range provided.

 * 

 * @param string $ipv4

 * @param string $ipRange

 * 

 * @return boolean

 */

function ipv4_in_range($ipv4, $ipRange) {

	$smask = explode('/', $ipRange, 2);

	$subnet = $smask[0];

	$mask = intval($smask[1]);

	

	unset($smask);



    if ((ip2long($ipv4) & ~((1 << (32 - $mask)) - 1) ) == ip2long($subnet))

    { 

        return true;

    }



    return false;

}



/**

 * Checks if given IPV6 is in the IPV6 Range provided.

 * 

 * @param string $ipv6

 * @param string $ipRange

 * 

 * @return boolean

 */

function ipv6_in_range($ipv6, $ipRange) {

	list($subnet, $mask) = explode('/', $ipRange);

	

	$subnet = inet_pton($subnet);

	$ipv6 = inet_pton($ipv6);

	

	$address = str_repeat('f', $mask / 4);

	if ( ($mask % 4) == 1)

		$address .= '8';

	if ( ($mask % 4) == 2)

		$address .= 'c';

	if ( ($mask % 4) == 3)

		$address .= 'e';

	

	$address = str_pad($address, 32, '0';

	$address = pack('H*', $address);

	

	return ($ipv6 & $address) == $subnet;

}

Doing it via PHP, is not a good way of doing it - should do it via your web server config - way faster.

Yeah, but some people don't know how to or don't want to do it through the Web Server config.
This script is for those people who would rather like to include a simple php file.