XF Bot Guard 1.4.1

Where is the full documentation?​

Full setup, configuration, privacy, Cloudflare, cache/CDN, troubleshooting, and support details are here:

XF Bot Guard documentation

Do I need Cloudflare?​

No.

XF Bot Guard runs inside XenForo. Cloudflare Edge Enforcement is optional for sites that want to push high-confidence repeat offenders to Cloudflare Managed Challenge.

Will it block Google, Bing, or other legitimate crawlers?​

It is designed not to.

XF Bot Guard can allow verified crawlers after proper verification. A crawler-looking user-agent alone is not trusted, so fake Googlebot/Bingbot-style traffic can still be challenged or logged.

Will real users get CAPTCHA constantly?​

They should not.

Normal visitors should usually pass browser validation and continue browsing. Suspicious visitors may see validation or CAPTCHA depending on risk score, browser proof, cookies, network behaviour, route activity, and your settings.

Can I test it before enforcing?​

Yes.

Install it, leave it disabled, run the Health check, then use cautious settings or Observe-only. Observe-only logs what Bot Guard would have done without actually challenging, denying, or blocking visitors.

Will it break login, registration, APIs, webhooks, or payment callbacks?​

Default exclusions are designed to avoid that.

Admin, login, register, API, webhook-style paths, CAPTCHA, static assets, robots.txt, sitemap-style paths, and similar sensitive routes are excluded by default. Custom third-party endpoints should still be reviewed and explicitly excluded when needed.

Is this DDoS protection?​

No.

XF Bot Guard is XenForo application-layer bot protection. It helps with abusive bots, scrapers, fake browsers, crawler abuse, and bot-driven origin load that reaches XenForo. Volumetric attacks still need upstream mitigation.

Will it stop every bot?​

No.

Advanced bots can run JavaScript, keep cookies, rotate IPs, use residential proxies, mimic browsers, and solve CAPTCHA. XF Bot Guard raises the cost of abuse and gives admins better visibility and control.

Does it store raw IP addresses?​

Core Bot Guard reputation data is designed around hashed identifiers.

Raw IP storage is optional and mainly required for Cloudflare Edge Enforcement. Do not enable raw IP storage or live Cloudflare syncing without understanding the privacy implications for your site.

What if something goes wrong?​

Disable XF Bot Guard from Options > XF Bot Guard, clear any CDN/full-page cache that may have cached validation or challenge responses, then check the Health check and Raw event log.

If you cannot access the Admin Control Panel, use your normal XenForo add-on recovery process.

Is it GDPR-compatible?​

XF Bot Guard provides a GDPR-compatible operating mode called Privacy-assured protection mode. When enabled, it reduces passive browser fingerprinting and persistent browser storage on ordinary page views while still allowing enhanced browser validation when protected traffic needs proof. Pair it with Light-DB runtime mode when database minimisation is also required. This supports a privacy-conscious security posture, but it is not a legal compliance guarantee by itself, so your site’s privacy, cookie and storage notices should still reflect your actual configuration.