FRD-002Get the real client IP without trusting a spoofable headerEvery per-IP limit you have is only as good as this function. Reading X-Forwarded-For unconditionally hands attackers a free reset on all of them.PHPTested on PHP 8.2, MariaDB 10.6