This depends on the user's environment, but since the x-forwarded-for header can be easily spoofed, it should only be checked if explicitly set to be checked by an admin with knowledge of the proxy. So we can continue to check the remote address header for the IP address, and use the x-forwarded-for IP address in place of it if configured to do so. And also fallback to the remote address if the x-forwaded-for address is not available or unknown.

How about a system setting under Settings > System > General > Basic Setup that says something like:

[x] My installation is behind a load balancer

? Tooltip "If checked, Blesta will look for an x-forwarded-for header when evaluating IP addresses for logging, GeoIP, fraud detection, and other purposes."

Something like that could work, but the language may need to be updated. Is there no other reason to use the x-forwaded-for header other than when behind a load balancer?

HTTP Proxy or load balancer, so perhaps we should list those 2. Load balancer will be the most common, and it is technically an HTTP Proxy. I got this from https://en.wikipedia.org/wiki/X-Forwarded-For while looking to see if there are any other reasons an x-forwarded-for header would be passed through.. proxy & load balancer pretty much sum it up.