wf_server_client_ip only ever used the raw TCP peer address, which behind a reverse proxy (nginx, a Cloudflare Tunnel, etc.) is always the proxy's own address, not the real client's. Every downstream consumer of that value -- the built-in IP-keyed rate limiter in particular -- effectively collapses every real user behind the proxy into a single shared bucket, so one abusive or buggy client can exhaust a login-attempt limiter and lock out everyone else. Add wf_xrpc_server_set_trusted_client_ip_header(server, header_name) to opt into trusting a specific header (e.g. "CF-Connecting-IP") instead of the socket peer. Off by default; only safe when the deployment topology guarantees the header can't be forged end-to-end (i.e. the proxy always overwrites or strips any client-supplied copy before setting its own).