DDoS Help

[Lunar Ronin]

Running XenForo 2.3 on semi-dedicated cPanel hosting. In mid-June, the forum began suffering a mild DDoS. I strongly suspect LLM scrapers. Last month, it ramped up severely to cause two periods of several hours of downtime due to 500 errors. The host confirmed that it was a DDoS targeting the forums' search. So we removed the ability for guests to run a search, did some htaccess tricks to limit guests, and blocked the heaviest hitting IP addresses which were all from China. That stopped it.

Starting late last night, they came back with a vengeance. 500 errors, the forum has been down for several hours now, and there's no sign of letting up. The cPanel log shows dozens to hundreds of attempted connections per second. This time the IP addresses are from a range of countries, Brazil, Turkiye, China, the United States, etc.

I know the general solution is Cloudflare, but I was banned from Cloudflare years ago. I have no idea why. Five or six years ago, I created a Cloudflare account and bought three domain names from Cloudflare to try them out as a domain registrar. They were for future projects with no immediate use. Exactly a month later, Cloudflare banned my account and refunded the money for all three domain names. No reason was provided. I did absolutely nothing other than register three domain names. That was the only action I took on the account.

Now that my XenForo forum is getting DDoSed, I'm a bit stuck. Any suggestions?

 

[Starlinkhispano]

Since you were a country getting the Cloudflare ? You've looked at this add-on, maybe I'll regulate the attacks a little

XF Bot Guard

May 28, 2026

Challenge suspicious bots before they scrape your forum.

• zeeb0t
• abuse bot bot blocking bot detection captcha fingerprinting scrapers scraping security spam
• Add-ons [2.x]

 

[AndyB]

You might like this add-on:

https://xenforo.com/community/resources/human-verification.10589/

 

[zeeb0t]

Since you were a country getting the Cloudflare ? You've looked at this add-on, maybe I'll regulate the attacks a little

XF Bot Guard

May 28, 2026

Challenge suspicious bots before they scrape your forum.

• zeeb0t
• abuse bot bot blocking bot detection captcha fingerprinting scrapers scraping security spam
• Add-ons [2.x]

Thanks for the recommendation. For OP: there are some add-ons like mine linked here.. which are extensively designed to identify bots, even those that do not identify themselves as one. Then, there are some which are more basic - they might crudely work, but won't rid yourself of complex bots or those who try to hide their identity. Some also try to CAPTCHA all traffic and are, IMO, not ideal. Anyway, feel free to try mine out or others, depending on your needs, you will find the right one.

 

[JustinHawk]

Running XenForo 2.3 on semi-dedicated cPanel hosting. In mid-June, the forum began suffering a mild DDoS. I strongly suspect LLM scrapers. Last month, it ramped up severely to cause two periods of several hours of downtime due to 500 errors. The host confirmed that it was a DDoS targeting the forums' search. So we removed the ability for guests to run a search, did some htaccess tricks to limit guests, and blocked the heaviest hitting IP addresses which were all from China. That stopped it.

Starting late last night, they came back with a vengeance. 500 errors, the forum has been down for several hours now, and there's no sign of letting up. The cPanel log shows dozens to hundreds of attempted connections per second. This time the IP addresses are from a range of countries, Brazil, Turkiye, China, the United States, etc.

I know the general solution is Cloudflare, but I was banned from Cloudflare years ago. I have no idea why. Five or six years ago, I created a Cloudflare account and bought three domain names from Cloudflare to try them out as a domain registrar. They were for future projects with no immediate use. Exactly a month later, Cloudflare banned my account and refunded the money for all three domain names. No reason was provided. I did absolutely nothing other than register three domain names. That was the only action I took on the account.

Now that my XenForo forum is getting DDoSed, I'm a bit stuck. Any suggestions?

If you need help in server configuration let me know. I can help you setup it properly to handle load. Feel free to DM me if interested.

 

[Suzanne O]

Also Try this site https://www.trendmicro.com and follow the prompts with it's help. It's an Internet security thing you can use