// Toggle ON/OFF
define('IP_POST_PROTECTION', true);

// Allowed IPs (single IPs or CIDR ranges)
$allowed_ips = [
    '123.123.123.123',      // Example single IP
    '192.168.1.0/24',       // Example range
];

// Only protect POST requests
if (IP_POST_PROTECTION && $_SERVER['REQUEST_METHOD'] === 'POST') {

    // Get real IP (Cloudflare safe)
    $ip = $_SERVER['REMOTE_ADDR'] ?? '';

    if (!empty($_SERVER['HTTP_CF_CONNECTING_IP'])) {
        $ip = $_SERVER['HTTP_CF_CONNECTING_IP'];
    }

    // Function to check IP or CIDR
    function ipInRange($ip, $range) {
        if (strpos($range, '/') === false) {
            return $ip === $range;
        }

        list($subnet, $bits) = explode('/', $range);
        $ip = ip2long($ip);
        $subnet = ip2long($subnet);
        $mask = -1 << (32 - $bits);
        $subnet &= $mask;

        return ($ip & $mask) === $subnet;
    }

    $allowed = false;

    foreach ($allowed_ips as $allowed_ip) {
        if (ipInRange($ip, $allowed_ip)) {
            $allowed = true;
            break;
        }
    }

    if (!$allowed) {
        http_response_code(403);
        exit('Forbidden - Your IP is not allowed.');
    }
}