XF Bot Guard 1.4.1

XF Bot Guard 1.4.1

Important upgrade notes for existing customers:

When XF Bot Guard is enabled, XenForo ACP one-click upgrades now check the live XF Bot Guard support declaration before the XenForo upgrade download begins. If the target XenForo version is above the currently declared supported version, or the declaration cannot be checked or parsed, the form shows a warning and requires explicit confirmation. Manual file-upload upgrades and CLI upgrades are not gated by this warning.

Release type: minor

XF Bot Guard 1.4.1 is a backwards-compatible release focused on safer XenForo upgrades, more reliable challenge handling, cleaner crawler responses, clearer diagnostics and lower runtime overhead. XenForo and PHP requirements are unchanged.

Safer XenForo one-click upgrades

XF Bot Guard now helps protect administrators from upgrading XenForo beyond a version that has been declared compatible with XF Bot Guard. During XenForo’s ACP one-click upgrade flow, the add-on checks the current support declaration and displays a confirmation warning if the target XenForo version is not yet confirmed, or if the check cannot be completed safely.

This works automatically when XF Bot Guard is enabled. It does not block manual file-upload upgrades or CLI upgrades.

More reliable CAPTCHA challenge rendering

CAPTCHA challenge rendering now follows XenForo’s public view-rendering lifecycle more closely. This makes challenge pages more reliable across CAPTCHA providers and avoids brittle rendering failures in cases where the provider needs the final page-rendering context.

If a CAPTCHA provider changes during a visitor’s challenge session, XF Bot Guard retries the challenge cleanly instead of treating the visitor as a failed submitter. Broken or unavailable CAPTCHA provider configuration is reported through a normal public error response rather than producing a malformed challenge page.

Cleaner handling for verified crawlers

Verified and known crawler allow decisions no longer emit unnecessary Bot Guard browser collector output. This keeps crawler responses cleaner and avoids sending irrelevant browser proof scripts to traffic that has already been allowed as crawler traffic.

This behaviour is automatic and follows the existing crawler verification and known-crawler allow configuration.

Clearer health checks and support diagnostics

Health check and support bundle output has been expanded so administrators and support can see more useful operational state when troubleshooting. The diagnostics include clearer cache, fallback and runtime signals while continuing to redact sensitive values from support output.

This works automatically after upgrade and does not require configuration.

Lower overhead on busy forums

This release includes targeted runtime and maintenance optimisations that reduce repeated work without changing protection policy. Dashboard snapshot metric writes are batched more efficiently, event-count fallback queries are grouped where possible, admin diagnostic phrase loading is reduced, and large cleanup tasks use bounded cursor-based scans so maintenance can resume without repeatedly walking entire tables.

Crawler verification, self-server IP checks, protected HTML analysis, link chronology, contextual canaries, Light-DB telemetry and online visitor identity lookups also reuse more request-local or cached work. In practical terms, busy forums should see smoother scheduled maintenance, fewer repeated database operations, less duplicate request processing, and safer handling when shared-hosting restrictions block optional host signals.

XF Bot Guard 1.4.0

Release type: minor

XF Bot Guard 1.4.0 expands Light-DB reporting, improves the performance of large Raw Event Logs, prevents overlapping background maintenance, strengthens outbound HTTP security and introduces a broad range of runtime and architectural optimisations.

Country Pressure Analytics for Light-DB Mode

The Dashboard can now display approximate Country Pressure metrics while Light-DB runtime mode is active. This shows which countries are generating sessions that required a hard intervention, reached a browser-validation dead end or, in Observe-only mode, would have been challenged or denied. The figures are session-oriented, best-effort hourly aggregates stored in XenForo’s application cache rather than raw public request rows, allowing Light-DB users to retain useful geographic abuse visibility without giving up the reduced database-write benefits of Light-DB mode. No additional option is required: it is enabled automatically when Light-DB runtime mode is active and appears in the existing Dashboard Country Pressure panel as new hourly snapshots are generated.

Safer Background Maintenance and Smarter MMDB Retries

All XF Bot Guard cron entries now use durable execution locks to prevent the same scheduled task from running more than once at the same time. If a previous run is still active, the overlapping run exits safely and schedules a near-term retry instead of competing for database, CPU, network or filesystem resources. The same protection has also been extended to Health-triggered maintenance tasks, reducing the risk of cron, queued jobs and manual repairs attempting the same work concurrently. This protection is automatic after upgrading.

IPLocate/MMDB refreshes also handle interrupted or runtime-limited downloads more intelligently. Partial progress is now recorded and temporarily backed off before another attempt, starting at five minutes and increasing up to one hour when repeated attempts make no progress. Existing partial downloads can still be resumed, but a short cron cycle can no longer repeatedly hammer the distribution endpoint or the forum server when a large download cannot complete within the available runtime.

Faster Raw Event Log Navigation

The admin Raw Event Log now uses cursor-based navigation instead of numbered pages backed by database row counts and increasingly expensive SQL offsets. Admins can move between Newer events, Newest events and Older events, with the current filters preserved. This keeps navigation fast and predictable even when the event table has grown large, while also avoiding a separate full matching-row count whenever the log is opened. The improvement is automatic and does not change CSV exports, event filtering or individual event details.

Hardened Fixed-Destination Outbound Requests

Outbound requests intended for a specific service are now more strict about remaining at that destination. Cloudflare API requests no longer follow HTTP redirects, and the api64.ipify.org fallback used to identify the forum server’s public IP now also rejects redirects. This prevents a trusted fixed endpoint from silently sending Bot Guard—and potentially its request headers—to an unexpected destination. No configuration change is required.

Runtime Efficiency and Internal Architecture Improvements

A range of public-request and admin paths now reuse request-scoped dependencies instead of repeatedly constructing the same option readers, crawler verifiers, Edge Enforcement services, Light-DB runtime services, privacy-mode helpers and collector services. Online activity ownership and Known Bots compatibility checks have also been centralised so the same decisions and option state can be reused throughout a request. These changes reduce duplicated work, object churn and incidental CPU and memory overhead, particularly around request assessment, browser-validation collection, Light-DB telemetry and adjusted online counts.

Several of Bot Guard’s largest internal components have also been broken into smaller, focused services. Dashboard snapshot generation now uses dedicated metric collectors, Dashboard reporting uses dedicated read models, challenge decisions use separated risk-assessment and decision-support components, and shared locking, schema metadata, SQL validation and event-log filtering logic have been consolidated. The release tooling has also gained stronger schema/query contract checks, dead-code review safeguards and package cleanliness checks. These changes do not add new settings, but reduce code duplication and behavioural drift, make failures easier to isolate and provide a safer foundation for future Dashboard, protection and performance improvements.

Forum Identification on Outbound Bot Guard Requests

Bot Guard’s outbound User-Agent can now include the forum’s configured Board URL, for example (forum: https://example.com/community). This allows external service operators to identify which forum installation is making a request, distinguish legitimate Bot Guard traffic and more easily investigate rate limits, unexpected traffic or support issues. Only a safely validated Board URL is included: URLs containing credentials, query strings, fragments, control characters or other unsafe formatting are omitted, and Bot Guard falls back to its previous generic User-Agent. This does not transmit visitor IP addresses, visitor user agents, cookies, browser signals, forum content or raw event data. No separate setting is required; ensure XenForo’s Board URL is configured correctly.

XF Bot Guard 1.3.9

Release type: Minor

XF Bot Guard 1.3.9 focuses on better admin visibility, cleaner operational diagnostics, tidier analytics data, and lower internal overhead across a number of hot paths. There are no required upgrade steps for existing customers.

Dashboard Overview on the ACP Home Page

Admins can now see the XF Bot Guard Dashboard Overview directly on the XenForo ACP home page. This gives you a quick 24-hour snapshot of Bot Guard activity without needing to open the full dashboard first, including the main overview cards, outcome mix, pressure trend, and country pressure information where supported by the active reporting mode. It matters because Bot Guard status is now visible as soon as an admin enters the ACP, making unusual bot pressure or protection activity harder to miss. This is enabled by default for admins with the View XF Bot Guard permission. You can disable it from the XF Bot Guard options by turning off Show Dashboard Overview on ACP home.

Health Check Diagnostics for Material Caught Failures

The Health check page now includes cache-backed diagnostics for material caught failures. When XenForo application cache is available, Bot Guard records the most common reviewed caught-failure paths and shows them in the Health check area, including count, last seen time, feature area, diagnostic target, catch site, exception class, and redacted diagnostic details. This matters because some failures are intentionally caught so the site can keep running safely, but they should not be invisible when they point to a real operational problem. There is no separate option to enable. Open the XF Bot Guard Health check page to view it. Full messages and stack traces require the sensitive Bot Guard admin permission, and these diagnostics are not included in the Support bundle.

Cleaner Google Analytics Data on Bot Guard Verification Routes

Bot Guard-owned public routes now suppress XenForo’s native Google Analytics template. This applies to Bot Guard operational pages such as challenge, collect, solve, and visitor-report routes, while normal forum pages continue to use your existing XenForo analytics configuration. This matters because Bot Guard verification traffic is not normal content traffic, and allowing it into analytics can muddy reporting with bot, challenge, or validation activity. There is nothing to configure; it is applied automatically on Bot Guard-owned public routes only.

Lower Overhead for Redaction and Contextual Canary Sampling

This release reduces unnecessary CPU work in two busy internal areas. Sensitive diagnostic array redaction now reuses per-call key and header checks instead of repeatedly recalculating the same decisions across nested diagnostic structures. Contextual link canary sampling has also been tightened so it samples only the bounded number of candidate links it needs, rather than shuffling the full candidate list first. This matters most on larger pages, larger diagnostic payloads, or higher-traffic sites where small repeated costs add up. There is no setting to enable; the improvements apply automatically.

General CPU, Memory, and Refactoring Improvements

A broader cleanup pass removes unused internal methods, stale helper surfaces, and redundant state that no longer needs to exist. Examples include moving shared Dashboard preparation into a dedicated Dashboard view-data service, narrowing the ACP home overview aggregation so it only fetches the data that overview needs, removing unused compatibility helpers, and trimming dead internal paths from maintenance, challenge, cron, Light Response, and repository services.

The practical benefit is a cleaner and easier-to-maintain codebase with less unnecessary work in runtime and admin paths. This does not change how customers configure Bot Guard, but it should reduce the chance of future regressions by making the code paths simpler, more focused, and easier to test.

Advisory Dead-Code and Performance Benchmark Suites

The development toolchain now includes advisory dead-code analysis and PHPBench performance benchmark suites. These cover a wide range of Bot Guard internals, including dashboard aggregation, response HTML scanning, contextual canaries, Link Chronology, packed IP lookups, event-detail buffering, Cloudflare planning, Web Bot Auth parsing, risk scoring, and sensitive diagnostic redaction. This matters because future optimisations and cleanups can be checked against repeatable performance and usage-analysis tooling instead of relying only on manual inspection.

These tools are for development and release validation, not customer-facing ACP features. Customers do not need to enable or run anything.

XF Bot Guard 1.3.8

Release type: minor

Important: This update fixes a reported issue with MMDB-related crons. If you disabled these, please ensure they are enabled once more after applying the update.

XF Bot Guard 1.3.8 is a reliability, privacy, dashboard, and performance hardening release. The headline improvement is safer background work: Bot Guard now does more maintenance in smaller, resumable chunks, with better Health Check visibility when cron work is missing, delayed, or misconfigured. This release also adds a new privacy-assured protection mode, improves Light-DB dashboard behaviour, reduces known crawler lookup overhead, updates the beta Web Bot Auth fallback, and includes a broad optimisation/refactoring pass across CPU, memory, database, and cache-heavy areas.

Safer resumable background maintenance

Bot Guard’s cron-driven work is now budget-aware, resumable, and health-visible. Instead of assuming a long task will finish in one run, Bot Guard now works within the effective PHP/XenForo runtime budget, stops before the server kills the process, and resumes from saved progress on the next run. This applies across cleanup, dashboard snapshots, known crawler refreshes, ASN/CIDR refreshes, MMDB and geo-index maintenance, Cloudflare sync, event detail flushing, and online challenge cleanup. For customers, this means fewer cron timeouts, fewer half-completed maintenance runs, and better behaviour on shared hosting or tighter PHP execution limits. There is nothing new to enable; keep XenForo cron running normally and use the Bot Guard Health Check to see whether any Bot Guard cron entries are missing, inactive, misconfigured, delayed, or scheduled incorrectly.

Privacy-assured protection mode

A new privacy-assured protection mode gives privacy-sensitive sites a lower-storage deployment option while preserving Bot Guard’s ability to protect important traffic. When enabled, ordinary page views do not passively pre-warm the browser proof collector or write the usual persistent browser collection marker. Bot Guard still performs full proof collection when it is actually needed, such as bootstrap validation, forced recollection, or protected no-proof validation. Proof cookies also use a shorter lifetime while this mode is active. You can enable it from the Bot Guard quick settings/recommended settings area or the main Bot Guard options. This is useful for sites wanting a more GDPR-compatible security posture, especially when paired with Light-DB runtime mode, but it is not a legal compliance guarantee by itself. Because proof is collected more on-demand, some users may see validation at the first protected action more often than in the normal pre-warmed mode.

Cleaner Light-DB dashboard reporting

The dashboard now understands Light-DB runtime mode more accurately. When Light-DB is active, Bot Guard hides raw-log and session-style panels that cannot be supported without full raw public telemetry, instead of showing empty, misleading, or incomplete dashboard sections. It also adds more Light-DB-friendly aggregate reporting, including challenge and decision outcomes, approximate pass/failure pressure, risk samples, reason groups, CAPTCHA trust activity, estimated trusted sessions, and observe-only pressure where available. To use this, enable Light-DB runtime mode as normal; the dashboard now adapts automatically. Standard database-backed dashboard behaviour remains available when Light-DB is not active.

Faster known crawler range checks

Known crawler verification can now use a compact XenForo application-cache directory for crawler IP ranges. In practical terms, Bot Guard can often verify known crawler range matches without repeatedly falling back to heavier database lookups or per-IP cache writes. This is especially useful for busy public sites with frequent Googlebot, Bingbot, AI crawler, or other known crawler traffic. If the compact cache is unavailable, stale, malformed, or mismatched, Bot Guard safely falls back to the normal database-backed range lookup. There is no separate feature switch; it is used automatically when XenForo application cache is available and the known crawler refresh process has run successfully.

Updated beta Web Bot Auth fallback

The beta Web Bot Auth fallback has been updated to align with the replacement IETF draft direction for signed bot identity headers. The verifier now handles the newer Signature-Agent directory-style member structure, links Signature-Input coverage to the correct Signature-Agent member, rejects unsupported discovery types more strictly, and improves how built-in bot profiles resolve their configured key directories. This only affects the beta Web Bot Auth fallback path; normal verified crawler checks such as IP range, reverse DNS, and known source handling still run first. To use it, enable the beta Web Bot Auth fallback option. Sites using custom Signature-Agent patterns should ensure they are matching trusted HTTPS directory identities.

Leaner Link Chronology state handling

Link Chronology target hashing has been tightened up so repeated protected-link targets are de-duplicated and stored through a dedicated state layer. This keeps chronology checks lighter on link-heavy pages, reduces repeated state payload, and avoids unnecessary cache/session bloat while preserving the same protection behaviour. There is nothing new to configure; if Link Chronology is enabled, the improved handling applies automatically.

Broader CPU, memory, database, and code-quality improvements

This release also includes a wide optimisation and refactoring pass across Bot Guard’s internals. Several duplicated query, filtering, decision, dashboard, and state-management paths have been consolidated into dedicated services. Examples include cleaner event-log filtering, reusable edge-IP query handling, centralised challenge decision result construction, dedicated contextual canary state handling, improved Link Chronology storage, cleaner dashboard reporting-mode boundaries, and more shared aggregation logic for dashboard snapshots. These changes reduce code redundancy and make future maintenance safer, while also cutting avoidable CPU and memory churn in busy paths.

There are also practical resilience improvements behind the scenes. Large maintenance operations now stage work more carefully, cache payloads are validated before use, malformed compact directories are invalidated instead of trusted, partial event buffers can resume rather than being reprocessed from scratch, and dashboard snapshots avoid mixing incompatible reporting modes. Customers do not need to enable these optimisations individually; they are part of the 1.3.8 upgrade and are intended to make Bot Guard quieter, faster, and more predictable under load.

XF Bot Guard 1.3.7

Release type: minor

XF Bot Guard 1.3.7 is a performance and resilience-focused release. It reduces database load on protected requests, strengthens bot-storm survival handling, adds faster geo lookups through compact cached geo data, improves Dashboard usefulness in Light-DB mode, adds soft country exclusions, and cleans up noisy Quick Settings and Health Check output.

Better survival during active bot storms

The Active Bot Storm quick setting now also brings in Origin Survival defaults. When your origin is under pressure, Bot Guard can shed ordinary unknown traffic with a lightweight 503 + Retry-After response before expensive page rendering, challenge rendering, PHP work, or database work makes the problem worse.

This matters during real bot storms because sometimes the safest response is not “show more challenges”, but “protect the origin until pressure clears”. Use this from Admin CP → XF Bot Guard → Quick settings → Active bot storm, or configure Origin Survival directly. You will be asked to acknowledge that real unknown visitors may temporarily receive 503 responses while pressure protection is active.

Lighter database use on protected requests

Light-DB mode is now cleaner on the public request path. Bot Guard no longer performs public telemetry reads from the Light-DB visitor, IP, and session tables when building risk data. That keeps Light-DB mode closer to its purpose: keeping high-volume bot traffic away from the growing telemetry tables.

Normal database mode also benefits. Risk-data lookups now select only the specific visitor, IP, and session columns needed for scoring instead of pulling full rows. This reduces database I/O and memory use on busy forums. Light-DB mode can be enabled from Options → XF Bot Guard → Light-DB runtime mode, or through Quick Settings. The narrower database reads apply automatically after upgrade.

Faster local geo lookups with compact geo cache pages

Bot Guard now builds a compact country/ASN index from the active IPLocate databases and can warm bounded geo-index pages into the XenForo application cache. Country and ASN lookups can then use these compact cached pages instead of repeatedly doing heavier MMDB reader work.

This improves performance for country-aware protection, crawler handling, reporting, exclusions, and bot bursts where many requests need geo checks. The compact index is validated before use and falls back to the normal MMDB reader if it is missing, stale, or unavailable. Keep the local IPLocate databases and XenForo application cache healthy; the new geo index cache warmer cron handles build, repair, and warming automatically.

Broader CPU and memory optimisation across the hot path

A lot of 1.3.7 is under-the-hood performance work. Bot Guard now reuses calculated protection facts within the same request, shares crawler allowance decisions, caches final request context, and avoids repeating policy, route, crawler, and country checks across different protection layers. This reduces duplicated work when multiple features are active at once.

HTML handling has also been tightened. Link Chronology and Contextual Canaries can now share response HTML analysis instead of independently scanning and building large intermediate structures. Anchor and form scanning uses lighter internal structures, and selected canary targets can be prepared during the shared scan. Maintenance and cleanup paths were tightened too, including bounded cleanup work and more selective query patterns. There is nothing to enable; these optimisations apply automatically and should be most noticeable on busy forums, cache-heavy pages, large telemetry datasets, and active bot bursts.

More useful Dashboard snapshots in Light-DB mode

When Light-DB runtime mode is active and XenForo’s application cache is available, Dashboard snapshots can now include approximate hourly public event totals from Light-DB cache telemetry. This gives Light-DB users more useful activity trends without reintroducing raw public telemetry writes to the database hot path.

This improves broad volume panels such as activity counters, browser validation, CAPTCHA, crawler, skip, and light-response totals. Panels that need durable raw dimensions remain limited to retained database-backed snapshot data. To use it, enable Light-DB mode with a healthy XenForo application cache and let the Dashboard snapshot cron run normally.

Soft country exclusions

A new Soft excluded countries option lets you choose countries where ordinary resolved visitors should not receive punitive Bot Guard handling. Matching visitors are not challenged, denied, light-responded, manually reported, or instrumented with contextual canaries after higher-priority exclusions, forced challenge rules, and trusted crawler checks have run.

This is useful when you want Bot Guard to remain active globally but avoid aggressive handling for selected countries. Configure it from Options → XF Bot Guard → Soft excluded countries. It only matches known/resolved countries from trusted proxy country data or local IP lookup. Unknown or unresolved countries do not match, and Origin Survival does not use this exclusion.

Cleaner Health Check results

Health Check severity has been cleaned up so expected states are not treated as warnings. Active Light-DB mode, disabled low-value logging, buffered event-detail writes, current origin pressure state, disabled optional crawler/rDNS features, fresh Dashboard backfill, cache probes that have not yet run, and normal pending detail files should no longer create unnecessary noise.

Warnings are now reserved for things that are more likely to need action, such as aged/stuck snapshots, old pending files, broken enabled features, compact geo index issues, or configuration that can materially reduce protection. There is nothing to enable; open Health Check after upgrading and it should provide a cleaner action list.

Simpler Quick Settings preview

Quick Settings previews are now shorter and easier to act on. The preview focuses on settings that will actually change, plus any blockers or acknowledgements that matter before applying the preset.

The old “not touched” table, info-only noise, and “will fix” preview rows have been removed. Observe-only mode is also separated more clearly from optional overlays, making the Quick Settings screen easier to understand. Use it the same way: Admin CP → XF Bot Guard → Quick settings, choose a preset, preview the actual changes, then apply.

XF Bot Guard 1.3.6

Important upgrade notes for existing customers:

Light-DB runtime mode requires XenForo application cache to be configured first. If you are not enabling Light-DB mode, no extra action is required. To use Light-DB mode, configure XenForo cache first: XenForo cache documentation.

Release type: major

XF Bot Guard 1.3.6 is a major performance and scalability release, introducing the new optional Light-DB runtime mode alongside broad CPU, memory, compatibility, and admin reliability improvements.

Light-DB Runtime Mode

This release adds an optional Light-DB runtime mode for sites that want normal Bot Guard public request protection with much lighter database usage. When enabled, XF Bot Guard keeps the normal protection flow running, but moves short-lived public request counters and runtime telemetry into XenForo application cache instead of writing the fastest-growing public telemetry rows into the database. This matters most on busy forums or during bot pressure, where request logging and counter writes can become a meaningful part of server load. To use it, first configure XenForo application cache, then enable Light-DB runtime mode from XF Bot Guard options or the reversible Quick settings card. The Health/status page will show whether the mode is active, whether cache readiness passed, and whether recent Light-DB telemetry is being seen.

Lower CPU and Memory Overhead

XF Bot Guard now does less repeated work during the request path. Counter reads and writes have been batched, request/policy decisions are cached more efficiently for the current request, geo lookups are deferred until needed, and shared HTML response analysis is reused where possible by features such as Link Chronology and contextual canaries. These changes benefit both normal DB-backed mode and Light-DB mode. There is nothing to enable; the optimisations apply automatically after upgrading.

Better Prefetch and Prerender Handling

Browser prefetch and prerender document requests are now treated as speculative, non-interactive traffic. XF Bot Guard can still protect the content, but it avoids trying to push these browser-initiated background requests through an interactive validation or CAPTCHA flow. This is better aligned with modern browser behaviour and XenForo’s newer handling of prefetch/prerender requests, and helps avoid wasting validation work on requests the visitor did not actively open. This behaviour is automatic and does not require a new setting.

More Compatible MMDB Reader Loading

Local IP country and ASN lookup now handles more MaxMind/MMDB reader loading scenarios safely. XF Bot Guard can use its bundled reader, a compatible official maxminddb PHP extension, or an already-loaded compatible PHP reader that passes local validation. This helps avoid local geo lookup issues on hosts where MaxMind reader classes are already loaded by PHP, Composer, extensions, or other add-ons. There is nothing to configure; after upgrading, check Health/status if you want to confirm the local IP database reader and MMDB files are available.

Admin Navigation Repair

The setup process now explicitly rebuilds XenForo’s Admin Control Panel navigation cache after XF Bot Guard repairs or removes its admin navigation entries. This fixes cases where Bot Guard admin links could be missing, stale, or not properly refreshed after install, upgrade, repair, or uninstall operations. No manual action is required; the repair runs as part of the normal add-on setup flow.

XF Bot Guard 1.3.5

Release type: minor

Runtime-managed local IP country/ASN databases

XF Bot Guard now manages the local IPLocate country and ASN databases as downloaded runtime resources instead of bundled package files. The add-on can refresh these databases through its MMDB refresh cron, store them under XenForo internal data, validate downloaded files before use, and continue using the previous known-good files if a refresh fails. This keeps local geo/ASN lookups private and fast, while making database updates safer and easier to maintain. Existing customers should not need to do anything manually; if there is a server or outbound connectivity issue, the Local IP country/ASN databases health check will report it.

More reliable fetching on dual-stack DNS servers

Outbound HTTPS source fetching is now safer on servers where a hostname resolves to both IPv4 and IPv6. XF Bot Guard can prefer a pinned public IPv4 address when available, helping avoid failures on servers where IPv6 DNS resolution works but IPv6 outbound connectivity does not. This improves reliability for crawler source refreshes, configured CIDR JSON sources, MMDB resource downloads, and other protected remote fetch paths. There is nothing to enable; the behaviour is automatic.

Housekeeping and internal hardening

This release includes general maintenance across packaging, setup helpers, health checks, encrypted secret handling, dashboard metric code organisation, and automated test coverage. These are not flashy changes, but they matter: they help make upgrades safer, reduce the risk of regressions, and keep the add-on easier to maintain over time. No customer action is required.

Smaller documentation image assets

Bundled documentation images have been compressed to reduce unnecessary package weight. This does not change Bot Guard behaviour, but it keeps the release package and local documentation assets lighter. There is nothing to enable or configure.

Optional BETA signed crawler verification fallback

XF Bot Guard now includes an optional BETA implementation of Web Bot Auth fallback verification. In plain English, this is an emerging way for recognised crawlers to cryptographically prove that a request really came from them. If the normal verified crawler checks do not produce a match, XF Bot Guard can optionally use Web Bot Auth signatures as a fallback verification path.

This feature is off by default because the specification is still in draft and not all crawlers or crawler requests support it yet. It does not automatically trust every signed bot: unknown signed bots are not treated as verified, malformed or expired signatures fail closed, and normal Bot Guard scoring continues when verification cannot be completed.

To try it, enable Allow verified search crawlers and fetchers, make sure XenForo application cache is configured and writable, then enable BETA (draft spec): Allow Web Bot Auth fallback for recognised crawlers. For non-built-in Signature-Agent identities, add trusted HTTPS origins under BETA (draft spec): Additional Web Bot Auth Signature-Agent patterns.

You can learn more about Web Bot Auth here:

https://developers.google.com/crawling/docs/crawlers-fetchers/web-bot-auth

XF Bot Guard 1.3.4

Important upgrade notes for existing customers:

Existing customers using Cloudflare Edge Enforcement should recreate the managed Cloudflare rule and IP list after upgrading.

Go to Overview → Disable Cloudflare managed rule → choose Delete managed rule and IP list. Then return to Overview and click Repair Cloudflare setup.

This is required because XF Bot Guard now uses stricter managed rule ownership tracking, so it updates the exact rule it owns instead of relying on a matching rule name or description.

Release type: minor

XF Bot Guard 1.3.4 is a safety and hardening release focused on Cloudflare Edge Enforcement reliability, safer external response handling, stricter bootstrap proof validation, cleaner URL unfurl behaviour, optional RSS/Atom feed exclusion, and small admin quality-of-life improvements.

Safer Cloudflare Edge Enforcement management

Cloudflare Edge Enforcement now identifies XF Bot Guard’s managed rule more strictly, reducing the risk of updating or deleting the wrong Cloudflare rule when another rule has a similar name or description. This makes the Cloudflare repair, disable and sync actions safer for existing Cloudflare setups. No new setting is required, but existing Cloudflare Edge Enforcement customers should follow the upgrade note above once after updating.

Bounded external response handling

External responses used by ASN range refreshes and Cloudflare API calls are now more tightly bounded. ASN WHOIS/IRR refreshes accept larger legitimate responses while enforcing a maximum response size and range count, and Cloudflare API responses are also capped to prevent unexpectedly large remote responses from consuming excessive memory or causing unstable admin actions. This is automatic when ASN-based network lists or Cloudflare Edge Enforcement are used.

Stronger bootstrap collection proof

Bootstrap collection now requires the correct bootstrap-specific collector proof instead of accepting a normal collector token in bootstrap-only paths. This tightens the early browser validation flow and prevents proof mixing between normal collection and bootstrap validation. There is nothing to enable; it applies automatically when bootstrap validation is in use.

Better URL unfurl redirect handling

Metadata-only light responses for URL unfurl agents now preserve valid XenForo redirects while still returning an empty body. This helps social preview and unfurl fetchers follow canonical redirects, such as post links redirecting to their final thread URL, without exposing protected page content on the redirect hop. This applies automatically when light responses are enabled and your URL unfurl user-agent patterns are configured.

Optional RSS/Atom feed exclusion

A new option, Exclude RSS/Atom feeds from protected areas, lets admins keep RSS and Atom feed requests outside protected Bot Guard handling. When enabled, feed requests are observed as not protected and do not enter protected scoring, challenge, deny, edge candidate, bootstrap or light-response handling. Leave it off if you still want Bot Guard’s existing non-interactive feed scoring and deny handling; enable it if your community depends on feeds staying openly available.

Narrower browser entropy and automation signals

Browser proof now includes a few additional narrow browser consistency and automation indicators, including extra Selenium/Phantom/Nightmare-style markers and Chrome object consistency checks. These signals give Bot Guard more evidence when assessing automated or unusual browser environments without requiring any admin configuration. They are collected automatically as part of the normal browser proof flow.

Dismissible support development reminder

Admins can now permanently hide the support development reminder shown on XF Bot Guard admin pages. Admins with XenForo option-management permission can dismiss it directly from the reminder, or manage it through the new Hide support development reminder option. This keeps the admin area cleaner once the reminder has been seen.

General hardening and cleanup

This release also includes broader reliability hardening across request classification, URL/path normalisation, non-page resource detection, Cloudflare sync state handling, operational fallback recording, support bundle detail, bundled asset inventory, and test coverage. These changes improve consistency around edge cases such as query-style routes, static resources, feed detection, same-origin URL handling and failure diagnostics. No action is required.

XF Bot Guard 1.3.3

Important upgrade notes for existing customers:

This release includes new bundled IP country/ASN lookup files and a local MMDB reader, increasing the add-on package size to approximately 30 MB.

If you normally upload add-ons through the XenForo ACP, you may need to increase your PHP post_max_size and upload_max_filesize settings to allow the larger upload. Otherwise, upload the files manually via FTP, SFTP, or SCP before running the upgrade.

Release type: minor

XF Bot Guard 1.3.3 is a reliability, visibility, and hardening release. It focuses on reducing false positives in normal XenForo navigation, improving country and ASN visibility, making Cloudflare Edge Enforcement more race-safe, tightening security token handling, and making admin configuration and support diagnostics easier to understand.

Improvement: Smarter Link Chronology for Forms and Redirects

Link Chronology now handles more normal XenForo navigation paths safely, including selected native form actions and same-origin redirect continuations. This helps reduce false positives when legitimate users move through areas such as search, tags, what’s new, and post-redirect flows, while still protecting against direct scraping of protected URLs that were never exposed to that visitor. Keep Link Chronology enabled under the XF Bot Guard options to use this; disable it only if you are doing a conservative rollout or your host’s WAF cannot be tuned.

Feature: Local Country and ASN Lookup Fallback

XF Bot Guard can now fall back to bundled local IP country and ASN databases when trusted proxy headers are not available. This means country and ASN-based signals are more useful on more hosting setups, without sending visitor IPs to an external lookup service during requests. Upload the full release package, then confirm the bundled databases are healthy in Advanced → Health check. No separate API key or external account is required.

Feature: Country Pressure Map and Table

The Dashboard now includes a country-pressure view showing where hard interventions, browser validation dead ends, and observe-only “would have intervened” sessions are coming from. This gives admins a clearer view of attack pressure by region, so they can make better decisions about network rules, regional patterns, and whether observe-only settings are behaving as expected. Open the XF Bot Guard Dashboard after upgrade; country-pressure data will begin accumulating from the time of upgrade and is not rebuilt retrospectively from existing dashboard snapshots.

Fix: Race-Safe Cloudflare Edge Queueing

Cloudflare Edge candidate queueing is now safer when multiple requests from the same IP qualify at the same time. Instead of failing on a duplicate queue insert, XF Bot Guard now reloads and updates the existing candidate record. This improves reliability during traffic bursts and helps Cloudflare Edge Enforcement keep accurate candidate state. There is nothing to enable; this applies automatically when Cloudflare Edge Enforcement is enabled.

Feature: Hard-Deny for Forced Challenge Networks

Forced challenge networks can now optionally be treated as hard-deny networks. This is useful when you have specific IPs, CIDRs, or ASNs where a challenge is no longer worth offering and you want XF Bot Guard to return a direct denial instead. Add the relevant networks to the forced challenge settings, then enable Hard deny forced challenge networks.

Feature: Admin-Defined Cleanup Prune Hours

Admins can now choose the hours during which XF Bot Guard cleanup pruning is allowed to run. This lets busy forums keep heavier cleanup work away from peak traffic periods. By default, cleanup remains allowed all day, so existing sites behave the same after upgrade. To use it, set the cleanup start and end hours in the XF Bot Guard options, then confirm the current cleanup window status in Advanced → Health check.

Hardening: CSPRNG-Safe Token Handling

Security-bearing tokens now use stricter secure random generation rules. If PHP’s secure random source is unavailable, XF Bot Guard will avoid minting affected security tokens rather than falling back to weaker values. This protects collector, return, continuity, report, and canary token flows from unsafe randomness. No setting is required; check Advanced → Health check to confirm secure random generation is healthy.

Documentation: ModSecurity / Comodo CWAF Compatibility

The documentation now includes specific guidance for hosts using ModSecurity or Comodo CWAF. Some generic WAF rules can false-positive on Bot Guard-owned cookies, especially when Link Chronology fallback cookies are present. The new guidance explains the symptoms, what to look for in WAF audit logs, and how to exclude only XF Bot Guard cookie values rather than disabling ModSecurity globally. Use this if your site sees WAF errors after enabling the more advanced protection signals.

Fix: Pre-XF 2.3 ACP Dark-Mode Display

XF Bot Guard’s ACP styling has been adjusted so older XenForo versions do not incorrectly receive XF 2.3-style dark-mode handling. This keeps Bot Guard admin pages more readable on pre-XF 2.3 installations while preserving modern dark-mode behaviour where supported. There is nothing to configure; refresh your admin browser cache if the old styling is still cached after upgrade.

Improvement: Better ACP Option Ordering

XF Bot Guard’s options have been reordered into a more logical flow. Related controls are now grouped more naturally, making the ACP easier to scan and reducing the chance that important settings are missed. Existing option values are preserved. Open the XF Bot Guard options after upgrading to see the updated layout.

Improvement: Clearer Phrases and Documentation

Phrases and documentation have been aligned across the add-on so the UI, docs, health checks, event log wording, Cloudflare Edge Enforcement wording, and support guidance use more consistent language. This does not change protection behaviour, but it makes setup, troubleshooting, and support conversations easier to follow after upgrade.

Hardening: PHP 7.2 Static Compatibility Gate

The release process now includes an additional compatibility gate for PHP 7.2-era syntax and signatures. This helps prevent accidental newer-PHP-only code from reaching customers who still run older supported XenForo/PHP environments. There is nothing to enable; this is a release quality check that makes upgrades safer.

Hardening: General Safety and Supportability Improvements

This release also includes smaller hardening work across request safety, outbound source fetching, crawler trust failure recording, attachment/resource exclusions, internal identifier guards, Cloudflare option-sync diagnostics, and support bundle health signals. These changes reduce edge-case false positives, make failed health states easier to diagnose, and keep sensitive diagnostics more controlled. No action is required; these improvements apply automatically after upgrade.

XF Bot Guard 1.3.2

Release type: minor

XF Bot Guard 1.3.2 focuses on lower server load, smarter forum-specific bot detection, and better stability on larger sites. It expands cache-backed reads across more protection hot-paths, adds new Link Chronology and dwell-time behavioural signals, improves dashboard reliability, and adds a new health check for Board URL origin issues.

Faster protection with cheaper hot-path reads

XF Bot Guard already used XenForo’s application cache on its primary hot-path. In 1.3.2, that cache-backed approach has been extended across every compatible hot-path, including areas such as counters, verified crawler lookups, network matching, light-response pattern parsing, contextual link canaries, and Link Chronology state. In plain terms, this means Bot Guard can avoid many repeated database read queries during busy traffic by reusing short-lived cached data where available.

There is nothing new to enable inside Bot Guard. If XenForo application cache is configured and hydrated, Bot Guard will use it automatically. If not, Bot Guard remains database-backed and continues to work normally, but busier forums should strongly consider enabling XenForo application cache. Memcached is the preferred recommendation, followed by Redis. APC/APCu can be useful for smaller single-server installs, but it is not the preferred recommendation for larger or busier communities.

Smarter forum-specific link journey checks

Link Chronology helps Bot Guard tell the difference between normal browsing and scraper-style URL traversal. When a visitor views a protected page, Bot Guard keeps a short-lived record of the protected internal links that were actually visible on that page. On the next protected request, it can tell whether the visitor is following a link they were recently shown, reloading the same page, or jumping directly to another protected URL that was not part of their recent journey.

This matters because real users usually browse through visible forum links, while bots often work from URL lists, guessed paths, scraped routes, or direct protected-page traversal. The signal is tailored to each forum because it is built from that forum’s actual pages, links, and route structure. It is enabled by default and can be tuned or disabled from the Link Chronology options. It adds bounded risk only; it does not hard-block anyone by itself.

Forum-specific dwell-time learning

Dwell-time learning gives Link Chronology a better idea of what “normal” browsing looks like on each individual community. Bot Guard samples eligible registered-user navigation to learn rough local bounds for how long people usually spend between protected page transitions. A fast-moving support forum, a long-form discussion forum, and a media-heavy community may all have different normal behaviour, so Bot Guard learns from the forum itself rather than relying on one fixed global rule.

This is designed to be privacy-preserving. Bot Guard does not need to identify individual members, store personal browsing histories, or know what someone personally read to build this model. It uses local aggregate behaviour to understand the forum’s normal rhythm, then adds bounded risk only when a protected link journey is unusually fast or unusually slow compared with that forum’s own normal pattern. If there is not enough local sample data yet, dwell-time scoring simply does not apply.

More reliable dashboard on larger sites

The dashboard now avoids loading unbounded route and timing metric rows into memory. Route reports are limited to the most relevant routes, route outcomes are fetched only for those selected routes, and timing summaries are calculated in a more memory-safe way.

This resolves dashboard memory exhaustion on larger or busier installations. There is nothing to enable; upgrade and use the dashboard as normal.

Board URL origin health check

The health check now validates XenForo’s Board URL origin against the current public request origin. This helps catch common configuration problems such as HTTP/HTTPS mismatch, wrong host, www/non-www mismatch, port mismatch, or proxy handling issues.

This matters because origin mismatches can affect same-origin browser validation, challenge URLs, and asset URLs. To use it, open the XF Bot Guard health/status page after upgrading and review the Board URL origin result. If it reports a problem, fix XenForo’s Board URL or your proxy HTTPS/host configuration, then re-run the check.

More consistent members online counts

Bot Guard’s online count adjustment now uses one consistent aggregate of XenForo session activity instead of combining separate reads that could briefly disagree under movement or load.

This fixes transient inconsistent public online totals, including member, guest, and challenged counts. It applies automatically when Bot Guard is enabled and the online count adjustment option is enabled.