title: Is it secure to just use $_SERVER['REMOTE_ADDR'] to display 'secret content' based on IP address?
body: <p>I have the following code to display secret content on a publically accessible webpage. This secret content is to only be seen by people 'sitting behind' 1-3 specific IP addresses. I've had a go with the code below using just <code>$_SERVER['REMOTE_ADDR']</code>and it works, I've previously <a href="https://stackoverflow.com/questions/1634782/what-is-the-most-accurate-way-to-retrieve-a-users-correct-ip-address-in-php?rq=1">read</a> that people also use: HTTP_X_FORWARDED etc, and that:</p>
  
  <blockquote>
    <p>If relying on IP addresses for something mission critical, resort to
    REMOTE_ADDR and don't bother catering to those behind a proxy.</p>
  </blockquote>
  
  <p>Is it secure to just use $_SERVER['REMOTE_ADDR'] to display 'secret content' based on IP address? </p>
  
  <pre><code>$allowed_ips = array(
      '111.222.333.444',
      '555.666.777.888',
      '999.111.222.333'
  );
  
  if (in_array($_SERVER['REMOTE_ADDR'], $allowed_ips))
  {
      echo 'this is secret stuff only for certain IPs';
  }
  </code></pre>