Akismet doesn't take the HTTP_X_FORWARDED_HOST into account, sees all comments as spam

[husky]

On some installations, requests are forwarded to separate 'PHP workers' and the original REMOTE_ADDR key in the $_SERVER superglobal might be changed to the forwarders IP instead of the original commenter. This means that all requests have the same REMOTE_ADDR when send to the Akismet servers and therefore are all seen as spam.

The forwarding servers add an extra header to the HTTP request called 'HTTP_X_FORWARDED_HOST' that contains the original IP.

I've attached a patch that uses this address if it's available, else it does take the normal 'REMOTE_ADDR' key into account.

[scribu]

This should be reported on the Akismet site.

[Denis-de-Bernardy]

#9235

[hakre]

Shouldn't this be closed as duplicate?

[miqrogroove]

wontfix is fine. I'd go so far as to say invalid because HTTP requests are not usable in the manner suggested by OP. You'd have a CVE slapped on WordPress trunk faster than you can finish beta testing.