Recent content by DeltaHF

I've had this problem as well. I have a very old forum (25 years) and hundreds of thousands of users. I handled it with a monthly routine. On the first of every month, I batch update all users who have not been active in the past year and set their Security Lock to "must reset password". It's...

Even after rolling this out, I'm still getting a ton of traffic to the "Log in" page on my XenForo site according to GA4 real-time reports. It can't be right, as it's a lot more traffic than Cloudflare or my raw logs are reporting. Something else is going on here, it might be some kind of...

Yes! This has been driving me crazy because I could not match up the Google Analytics hits to actual requests in my log file. Great idea! I've just set this up. For anyone wondering how, just search your PAGE_CONTAINER template and remove the data-xf-click="overlay" attribute from both your...

I'm using a Managed Challenge. Here are a few of my relevant rules. I have them separated so I can see exactly how much each route is being abused. 2.91M requests to /forum/search with a 0.01% solve rate...

Yes, that's a very important rule. Everyone using Cloudflare should use it, and if you're not using Cloudflare, keep an eye on your web server logs to see if you're being hit. The amount of abuse our search and whats-new pages have been receiving has been nothing short of ridiculous.

My site was flooded today as well. I've been very vigilant blocking ASN and IP addresses with Cloudflare, yet this morning, we had over 36,000 currently active users on the forums. Ridiculous.

Unfortunately this was not resolved in 2.3.8 or 2.3.9. The patches I posted above still work, but obviously will need to be applied manually again if you upgrade.

Yes, keep using Bunny. DO is just sending your server the attachment files for it to spit back out, as if it was actually hosting the files itself. Bunny is caching those files on its edge servers for your end users, acting as an actual CDN, and hopefully preventing your server from needing to...

Awesome news! Thanks for this! 💯 Great documentation is so important, and I was always a little confused by the old setup.

OAuth2 was introduced in 2.3? https://xenforo.com/community/threads/single-sign-on-and-more-with-oauth2-in-xenforo-2-3.217519/

Yep, you're right @Kirby. Disabled JavaScript and both files upload fine, as confirmed here in the test forum. It looks like the bug is in attachment_manager-compiled.js: // ... inside XF.ImageTools.resize ... return new Promise((e, f) => { if (a.type.startsWith("image/")) if...

The image-to-WebP conversion feature in XenForo 2.3 incorrectly rasterizes certain valid SVG files, causing the loss of their vector data. The behavior is inconsistent and appears to be triggered when an SVG file contains only a single color without an explicit transparent background. This...

Two functions in only one file need to be edited. It can be found at src/XF/Html/Renderer/BbCode.php.

I threw src/XF/Html/Renderer/BbCode.php along with descriptions, samples, and screenshots of the errors at Gemini 2.5 Pro and it offered its own suggested changes below. I have modified the two functions and tables appear to be working now. Formatting like color, bold, and italics are preserved...