Caddy itself has built-in support for correctly & safely parsing XFF via the trusted_proxies global option https://caddyserver.com/docs/caddyfile/options#trusted-proxi... The plugin should use the parsed client IP produced by this, but the plugin was written before trusted_proxies existed in Caddy. (Not excusing the mistake, but there's an "easy" solution if someone wants to resolve it.)

Again why mention the plugin? Just use the main caddy option… plugins are ment to expand caddy not replace existing directives

unless i am missing something and the plugin overrides default behavior then of course it’s to blame

I think a security plugin author should have the awareness that X-Forwarded-For is just a string of untrusted user input.

That definitely is the job of a security plugin author who uses the value.

Whether it's lesson number one or number two... Don't trust your inputs has got to be near the top of things you learn when doing anything with security.

Edit: now I've read the article... Shocked. The vast majority of this is trusting untrusted user input.