diff --git a/backend/src/middleware/rateLimiter.js b/backend/src/middleware/rateLimiter.js
index ed952d7..520c629 100644
--- a/backend/src/middleware/rateLimiter.js
+++ b/backend/src/middleware/rateLimiter.js
@@ -15,7 +15,7 @@ const rateLimiter = async (req, res, next) => {
   }
   
   try {
-    const ip = req.headers["x-forwarded-for"]?.split(",")[0].trim() || req.socket.remoteAddress || req.ip;
+    const ip = req.ip || req.socket?.remoteAddress || "global-rate-limit";
     const identifier = req.user?._id || ip || "global-rate-limit";
     const { success } = await ratelimit.limit(identifier);
     if (!success) {
diff --git a/backend/src/server.js b/backend/src/server.js
index c6a5a3f..517a03d 100644
--- a/backend/src/server.js
+++ b/backend/src/server.js
@@ -27,6 +27,8 @@ dotenv.config();
 dns.setServers(["1.1.1.1", "8.8.8.8"]);
 
 const app = express();
+// Enable trust proxy for reverse proxies (Render, Vercel, Nginx)
+app.set("trust proxy", 1);
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);