XF Bot Guard 1.4.1

[zeeb0t]

zeeb0t submitted a new resource:

XF Bot Guard - Challenge suspicious bots before they scrape your forum.

View attachment 338751

XF Bot Guard

Challenge suspicious bots before they scrape your forum.

XF Bot Guard is a XenForo-native anti-scraping and bot challenge layer designed to identify suspicious visitor behaviour, build reputation over time, and challenge risky traffic using XenForo’s own CAPTCHA system.

It is built for forum owners who are tired of anonymous crawlers, scrapers, aggressive bots, and repeat automated visitors...

Read more about this resource...

 

[Feline Forums]

YOO this looks great. We need this

 

[zeeb0t]

YOO this looks great. We need this

Thanks mate, appreciate it!

Definitely keen to hear how it performs on other boards during the beta. I have been using it in production for a while, so it's been through battle testing. However, every forum is probably a little different - hence the beta tag - and, I am here to help patch or explain etc. as needed. Looking forward to hearing more.

 

[zeeb0t]

zeeb0t updated XF Bot Guard with a new update entry:

Patch: v1.0.0

• Replaces existing v1.0.0 package as there was a literal 3 letter typo causing some class of bots to evade detection. Now patched.

Read the rest of this update entry...

 

[ENF]

Thanks mate, appreciate it!

Definitely keen to hear how it performs on other boards during the beta. I have been using it in production for a while, so it's been through battle testing. However, every forum is probably a little different - hence the beta tag - and, I am here to help patch or explain etc. as needed. Looking forward to hearing more.

So, are these addons you are making, purely LLM generated with instructions you put in? How much of it is human designed, written or reviewed?

 

[zeeb0t]

So, are these addons you are making, purely LLM generated with instructions you put in? How much of it is human designed, written or reviewed?

I'm a software engineer with over 20 years experience. Do I now code with AI? Sure. I love using Windsurf. Did I pair-code it with AI, design it, review it? Absolutely.

 

[smallwheels]

Error message upon install about unexpected contents:

 

[zeeb0t]

Error message upon install about unexpected contents:

View attachment 338757

One moment, I'll check my hashes.

 

[ENF]

I'm a software engineer with over 20 years experience. Do I now code with AI? Sure. I love using Windsurf. Did I pair-code it with AI, design it, review it? Absolutely.

That's really not what I asked, but it's fine.

 

[zeeb0t]

zeeb0t updated XF Bot Guard with a new update entry:

Release: v1.0.1

• Typo bug fix over 1.0.0 relase
• Fixes file hash issue

Read the rest of this update entry...

 

[zeeb0t]

That's really not what I asked, but it's fine.

You wanted an actual percentage? Well I use AI to write code with me all day long. Have you used Windsurf before? I would say these days its writing most of the boiler plate, to which I then go through and fix it all. Saves me a lot of time. I don't know percentages... I would say it's easily 50/50 work and speeds my productivity accordingly.

 

[zeeb0t]

Error message upon install about unexpected contents:

View attachment 338757

Please try version 1.0.1 released now. I repackaged with a version bump and rehashed. Hopefully all good now.

 

[smallwheels]

Installed it on my test forum, default settings. Visited as a guest from a different browser, using Opera VPN (so different IP as well). Got challenged directly. Ended up in a never-ending series of captchas with no way out. Either I am doing something wrong or this add on needs a bit of work.

 

[zeeb0t]

Installed it on my test forum, default settings. Visited as a guest from a different browser, using Opera VPN (so different IP as well). Got challenged directly. Ended up in a never-ending series of captchas with no way out. Either I am doing something wrong or this add on needs a bit of work.

Can you please give it a try with the following:

• Uninstall / delete in admin control panel
• v1.0.1 install
• Settings, no changes except
  • Enable XF Bot Guard

Then, when you are prompted to pass CAPTCHA, can you please take a screenshot - and make sure you are pressing the continue button after passing it?

 

[zeeb0t]

Installed it on my test forum, default settings. Visited as a guest from a different browser, using Opera VPN (so different IP as well). Got challenged directly. Ended up in a never-ending series of captchas with no way out. Either I am doing something wrong or this add on needs a bit of work.

p.s., feel free to ping me privately if you don't want to share too much here

 

[smallwheels]

Then, when you are prompted to pass CAPTCHA, can you please take a screenshot - and make sure you are pressing the continue button after passing it?

This time it worked. On the test server, I had the "consent manager" add on enabled which I now disabled. Possibly there was a conflict, as I could not agree to the cookie settings of the add on before. With this add on disabled I had no captchas. Not sure if this is good, as I clicked through threads and pages as fast as I could and then switched IPs and continued like that and and repeated it twice with a different IP. No interruptions. So either the add-on is good and did not see my behavior as suspicious though it was more than unusual or it is bad as it did not see my behaviors as suspicious. Hard to tell.

How would one test if it is working? There seem to be no logs either.

 

[zeeb0t]

Here is a little demo of it in action.

To view this content we will need your consent to set third party cookies.
For more detailed information, see our cookies page.

Accept third party cookies

And here is the test script code:

cat > xf-bot-guard-test.sh <<'BASH'
#!/usr/bin/env bash
URL="${1:-https://yourforum.com/}"
REQ="${REQ:-12}"

for i in $(seq 1 "$REQ"); do
SEP="?"
[[ "$URL" == *\?* ]] && SEP="&"
TEST_URL="${URL}${SEP}xfbg_test=$(date +%s%N)_$i"

OUT="$(curl -sS -L -A "xf-bot-guard-test no-js" -H "Cache-Control: no-cache" -w " HTTP:%{http_code} URL:%{url_effective}" "$TEST_URL" 2>&1)"
RC=$?

if [ "$RC" -ne 0 ]; then
echo "[$i/$REQ] CURL ERROR ❌"
echo "$OUT"
exit 1
fi

if echo "$OUT" | grep -Eiq 'Verification required|complete the verification check'; then
echo "[$i/$REQ] CHALLENGED ✅"
echo "XF Bot Guard is challenging the test visitor."
exit 0
fi

echo "[$i/$REQ] ALLOWED"
sleep 0.35
done

echo "No challenge detected."
echo "Check Bot Guard is enabled, CAPTCHA is configured, and this URL is protected."
BASH

chmod +x xf-bot-guard-test.sh
./xf-bot-guard-test.sh https://yourforum.com/

 

[zeeb0t]

This time it worked. On the test server, I had the "consent manager" add on enabled which I now disabled. Possibly there was a conflict, as I could not agree to the cookie settings of the add on before. With this add on disabled I had no captchas. Not sure if this is good, as I clicked through threads and pages as fast as I could and then switched IPs and continued like that and and repeated it twice with a different IP. No interruptions. So either the add-on is good and did not see my behavior as suspicious though it was more than unusual or it is bad as it did not see my behaviors as suspicious. Hard to tell.

How would one test if it is working? There seem to be no logs either.

Were you using the same browser where you were already authenticated? If you try out the test script https://pastebin.com/7pVNENC9 it will give you an immediate read that it is running at all.

 

[smallwheels]

Were you using the same browser where you were already authenticated?

Nope.

If you try out the test script https://pastebin.com/7pVNENC9 it will give you an immediate read that it is running at all.

Will possibly give it a try but not now. My test server is behind htpasswd protection (thus access via shell script won't work) and I currently don't have the time to fiddle around too much.

 

[zeeb0t]

Nope.

Will possibly give it a try but not now. My test server is behind htpasswd protection (thus access via shell script won't work) and I currently don't have the time to fiddle around too much.

No worries mate.

To give you a more concrete idea, on the default scoring the CAPTCHA threshold is 50 points.

A normal browser with JavaScript enabled, cookies working, and the Bot Guard fingerprint collector successfully running is not supposed to trip CAPTCHA just because you click through some threads quickly or change IP a couple of times. That kind of behaviour can be normal enough: mobile networks, VPN reconnects, ISP address changes, office networks, etc.

With a good-looking browser session, the obvious “bad client” scores are not present. In other words, you do not get these:

• missing/unconfirmed fingerprint: +25
• no cookie continuity: +20
• no JavaScript confirmation: +30

A no-JS/no-cookie client would usually score 75 and be challenged. A proper browser does not.

There are also negative scores / trust factors. For example:

• logged-in user: -30
• staff user: -100
• recently passed CAPTCHA / trusted session: reduced risk while trust remains valid

So if you are testing while logged in, or after already solving a challenge, even from a prior session using that browser, or as staff, you are making yourself much harder to challenge. For testing, it is best to use a logged-out guest session/private window and avoid solving the CAPTCHA unless you are testing the solve flow itself.

With the default scoring, examples of positive risk signals are:

• 80+ dynamic page events within 10 minutes: +30
• 120+ total Bot Guard events within 10 minutes: +30
• 5+ error-route hits within 10 minutes: +30
• 3+ sensitive/system route hits within 10 minutes: +20
• same fingerprint seen from 6+ IPs within 24 hours: +30
• same fingerprint seen from 2+ countries within 24 hours: +50
• same fingerprint seen from 3+ ASNs within 24 hours: +50
• 8+ different fingerprints from the same IP within 24 hours: +40
• recent failed CAPTCHA: +40
• fake/unconfirmed fingerprint cookie: +35

So, for example, just clicking around fast in a real browser might only get you +30, which is below the 50-point threshold. You would generally need something like 120+ requests in 10 minutes, or a combination such as lots of errors plus sensitive route hits, or many fingerprints from one IP plus a new fingerprint, or a fingerprint jumping countries/ASNs.

That is intentional. If a real browser with JS/cookies working were challenged simply because someone clicked fast and changed IP twice, the false positives would be ugly.

The quickest test is still the curl/no-JavaScript/no-cookie test, because it confirms the protection path is actually running. Since your test server is behind htpasswd, you can still run it by adding HTTP Basic Auth to curl, for example, run numerous of these:

curl -u username:password https://your-test-site.example/threads/example-thread/

Or add this to the test script’s curl command:

-u username:password

That should confirm very quickly whether Bot Guard is active at all. A no-JS/no-cookie curl-style request should normally get one bootstrap page at most, then be challenged on the next protected page request.

If you want to test manually with a browser and VPN, I would do it like this:

1. Uninstall and install the add-on, to clear the data tables.
2. Enable Bot Guard.
3. Immediately open a private/incognito window.
4. Make sure you are logged out.
5. Do not use a staff account.
6. Clear cookies for the test domain first.
7. Visit a protected thread page once and let it load normally.
8. Then disable JavaScript for the site, or block the /bot-guard/collect request in dev tools/uBlock/etc.
9. Click to another protected thread/page.
10. You should now be challenged, because the browser is no longer confirming JS/fingerprint/cookie continuity correctly.

Alternatively, to test the IP/fingerprint heuristics with a VPN:

1. Use a logged-out private window.
2. Keep JavaScript and cookies enabled.
3. Visit a protected thread page and let it fully load.
4. Switch VPN location to a genuinely different country, not just another endpoint in the same country.
5. Reload/visit protected pages again.
6. Repeat with another country if needed.
7. It should boost the score incrementally until triggered.

With default scoring, the same fingerprint seen from 2+ countries in 24 hours is +50, which is enough to hit the CAPTCHA threshold by itself. Same fingerprint across 3+ ASNs is also +50. Same fingerprint across 6+ IPs is only +30, so changing between a couple of nearby VPN endpoints may not be enough.

Also, if there are no logs at all, check whether logging is enabled and whether the route being tested is actually inside the protected scope. If the route is excluded or not protected, there will naturally be nothing useful to see.