diff --git a/content-editor.js b/content-editor.js
index a8783d9..6d210f0 100644
--- a/content-editor.js
+++ b/content-editor.js
@@ -459,6 +459,12 @@ function securityConfigIsValid() {
 }
 
 function getClientAddress(req) {
+  // The editor only listens on 127.0.0.1; the staging Nginx proxy supplies this header.
+  // This prevents all remote visitors sharing the proxy address in the rate limiter.
+  const forwarded = req.headers['x-forwarded-for'];
+  if (typeof forwarded === 'string' && forwarded.trim()) {
+    return forwarded.split(',')[0].trim();
+  }
   return req.socket.remoteAddress || 'unknown';
 }