Advanced Traffic Statistics: Access Counter, Live Radar, WAF & AI Bot Defense

Advanced Traffic Statistics: Access Counter, Live Radar, WAF & AI Bot Defense 1.9.13

No permission to download
Thank you and appreciate the updates.

BUT, I can not install or update 1.8.6 as XF rejects and errors out in my ACP.
The "unexpected error" you encountered is not a bug in the add-on, but was triggered by the extremely strict automated security systems (firewalls and scanners) of the XenForo Cloud servers, which are much more restrictive than traditional hosting environments.

The original 1.8.6 .zip package included the composer.json and composer.lock configuration files (which we used to natively integrate the geolocation library). The XenForo Cloud scanners, detecting these dependency configuration files, preemptively block the installation, generating a "false positive."

We have just updated and replaced the 1.8.6 release .zip file (the version number remains the same, but the package has been optimized for the Cloud). We removed the unnecessary configuration files (leaving only the pre-compiled libraries inside) and optimized some code to easily pass the automated security checks.

Please re-download the .zip archive and try the installation again. It should now proceed smoothly and without any hitches.

Let us know if the installation goes through successfully or if you need any further assistance
 
Gave it a shot, still on 1.8.5
Hi,

We have just made a specific structural adjustment to the .zip file to ensure full compatibility with XenForo Cloud systems.

Please re-download the latest package and try the installation again. Let us know if everything works smoothly now!
 
Could not process Statistiche-1.8.6.zip: The add-on 'Advanced Traffic Statistics 1.8.6' may not be compatible with XenForo Cloud: An unexpected failure occurred. Please try again later.
 
Could not process Statistiche-1.8.6.zip: The add-on 'Advanced Traffic Statistics 1.8.6' may not be compatible with XenForo Cloud: An unexpected failure occurred. Please try again later.
I updated the zip again. I sent you a PM for testing. Hopefully the cloud server will accept the zip this time.
 
Supergatto updated Advanced Traffic Statistics: Live Radar, WAF & AI Security with a new update entry:

Bot Honeypot Trap, hardened bot verification & XenForo Cloud compatibility

In this update, we've introduced an experimental active defense feature (the Honeypot Trap), a significant hardening of the bot verification engine, and a structural fix that attempts to make the add-on compatible with XenForo Cloud by restoring GeoIP resolution on every hosting environment.

NEW — Bot Honeypot Trap

The add-on can now actively hunt bad bots instead of just watching them.

  • Invisible trap link — When enabled, an invisible link is...

Read the rest of this update entry...
 
Supergatto updated Advanced Traffic Statistics: Live Radar, WAF & AI Security with a new update entry:

Datacenter Detection, Cloudflare support & GeoIP migration

A major update to bot protection and reliability, developed across the 1.9.x cycle. It adds a powerful new detection layer against modern scrapers, full Cloudflare / reverse-proxy support, and migrates the GeoIP engine to a freely redistributable database. Everything is summarised below.



🛡️ Datacenter (ASN) Detection

Modern scrapers are hard to catch: they run headless browsers with perfect user-agents and valid headers, sailing past traditional checks. But...

Read the rest of this update entry...
 
Supergatto updated Advanced Traffic Statistics: Access Counter, Live Radar, WAF & Bot Defense with a new update entry:

Advanced Traffic Statistics 1.9.3 — Structural improvements & XenForo 2.3.12 compatibility

A maintenance release that streamlines how the add-on loads its GeoIP library and confirms compatibility with the latest XenForo.

GeoIP library — cleaner loading
The MaxMind reader library is no longer loaded through a bundled Composer autoloader. The add-on now uses the server's native MaxMind support when available, and falls back to a lightweight bundled copy of the reader classes otherwise. This makes the package cleaner and lighter, removes the previous Composer dependency...

Read the rest of this update entry...
 
Supergatto updated Advanced Traffic Statistics: Access Counter, Live Radar, WAF & Bot Defense with a new update entry:

Advanced Traffic Statistics 1.9.4 — Redesigned Datacenter Intelligence & new animated widget

This release is all about making your traffic data readable. The Datacenter panel has been completely redesigned, detection coverage has more than doubled, and the sidebar widget gets a brand new animated chart.



🎨 Datacenter panel — completely redesigned

The Datacenter Traffic panel has been rebuilt from the ground up. Instead of plain numbers, you now get a proper intelligence dashboard:

  • KPI cards — Flagged today, last 7 days and...

Read the rest of this update entry...
 
The latest download is missing is library.

Class "MaxMind\Db\Reader\Decoder" not found at Statistiche/_libs/MaxMind/Db/Reader.php:106. This is a third-party XenForo add-on ("Statistiche") whose bundled MaxMind GeoIP library is missing a class file. The Reader.php is trying to use MaxMind\Db\Reader\Decoder, and PHP can't find that class.
 
The latest download is missing is library.

Class "MaxMind\Db\Reader\Decoder" not found at Statistiche/_libs/MaxMind/Db/Reader.php:106. This is a third-party XenForo add-on ("Statistiche") whose bundled MaxMind GeoIP library is missing a class file. The Reader.php is trying to use MaxMind\Db\Reader\Decoder, and PHP can't find that class.
Thanks a lot for the report — you found a real packaging bug.

The GeoIP reader library was bundled with its files in the wrong folder structure, so the Decoder class couldn't be located. On servers that have the native MaxMind PHP extension (like mine) the bundled library is never used, which is exactly why I never saw it — your report is the only reason it surfaced.

I've fixed the package structure and also hardened the loader: if the library is ever incomplete, the add-on now simply disables GeoIP lookup instead of throwing a fatal error.

Please download the 1.9.4 package again and reinstall — the problem should be gone. Let me know if anything else comes up.
 
Thanks a lot for the report — you found a real packaging bug.

The GeoIP reader library was bundled with its files in the wrong folder structure, so the Decoder class couldn't be located. On servers that have the native MaxMind PHP extension (like mine) the bundled library is never used, which is exactly why I never saw it — your report is the only reason it surfaced.

I've fixed the package structure and also hardened the loader: if the library is ever incomplete, the add-on now simply disables GeoIP lookup instead of throwing a fatal error.

Please download the 1.9.4 package again and reinstall — the problem should be gone. Let me know if anything else comes up.
Thanks for the quick fix.
 
Supergatto updated Advanced Traffic Statistics: Access Counter, Live Radar, WAF & Bot Defense with a new update entry:

Advanced Traffic Statistics 1.9.5 — New dashboard, privacy controls & zero external requests

This release redesigns the main dashboard, adds two privacy features, removes the last external CDN request, and fixes a GeoIP loading bug reported by a user. Recommended for everyone.



📊 Redesigned Statistics Overview

The overview section has been rebuilt as a proper analytics dashboard:

  • KPI cards — Online now, visitors today, bots today, threats blocked, monthly visitors and total unique visitors, each with its own colour-coded icon...

Read the rest of this update entry...
 
A word to everyone using Advanced Traffic Statistics 🙏

The last few releases have been the busiest in this add-on's history, and I wanted to step back for a moment and share where it's going — and to say thank you to everyone who has installed it, tested it, reported bugs and suggested ideas. I hope the recent updates have been useful on your boards.



From a visitor counter to a traffic intelligence platform

This add-on started life as a simple "who's online" widget. It counted visitors, showed a few charts, and that was it.

Then something changed on the web. Forums stopped being visited mainly by people. AI companies began harvesting community content at scale to train their models. Commercial crawlers started hammering boards for SEO data. And a new generation of scrapers appeared — headless browsers with perfect user-agents, valid client hints and JavaScript execution, indistinguishable from a real Chrome visitor by any traditional check.

Counting visitors was no longer enough. You needed to know who was really on your board, and be able to do something about it.

That's what this add-on has become.



Where it stands today

It sees everything.
The Live Traffic Radar shows every access in real time — IP, country, hosting provider, device, target URL, hit volume and a heuristic trust score. The redesigned dashboard turns that into readable intelligence: KPI cards with trend indicators, a 30-day datacenter activity chart, country rankings, and a global threat map showing interceptions as they happen.

It unmasks the disguises. Bots faking Googlebot are exposed through full Forward-Confirmed reverse DNS. Browsers claiming to be Chrome without valid client hints have their trust score destroyed. And the newest layer — Datacenter (ASN) Detection — catches what everything else misses: scrapers that pass every behavioural check but run on cloud infrastructure. Across 110 known hosting and VPN networks, from AWS and Azure down to the bulletproof hosts scrapers hide behind, it identifies not just that a visitor is suspicious, but exactly which provider they're operating from.

The identity column makes patterns jump out. When you see a dozen different IPs from four countries all claiming to be the same browser build, you're not looking at visitors — you're looking at one distributed scraping botnet, and now you can see it at a glance.

It fights back. AI Shield stops LLM scrapers from training on your community's content. Junk Shield blocks aggressive commercial crawlers and vulnerability scanners. Datacenter Shield drops headless traffic at the door. Emergency Mode is there for the bad nights. All of it before the page is even built, which means the CPU and bandwidth stay yours.

And it respects your visitors. Every asset is served from your own server — no external CDN calls at all. IP retention is yours to choose, from one day to ninety. Addresses can be blurred on screen so screenshots never expose them.



Free vs Pro — and why Pro matters

The free version is genuinely useful, and it will stay that way. You get the statistics, the demographics, the trends, and — importantly — datacenter detection's trust scoring, so you can see what's hitting your board.

But seeing and stopping are different things. The Pro licence is what turns visibility into defence: the active shields, the Live Radar with one-click IP banning, the full datacenter intelligence panel with provider identification and reputation lookups, and the complete threat analytics.

I'll be honest, because I'd rather earn your trust than oversell: no tool blocks everything. Anyone claiming otherwise is selling you something. Determined attackers on residential proxies will always be hard — that's why I recommend running this alongside a good edge layer like Cloudflare. But for the traffic that actually reaches your server, Pro gives you the complete arsenal rather than just the binoculars.

And there's a practical side: every Pro licence directly funds the development you've been seeing. This add-on is maintained by one person. The datacenter engine, the Cloudflare handling, the redesigned dashboard, the privacy controls — all of it came out of evenings and weekends, funded by the people who chose to support it. If the add-on has saved your board bandwidth or spared you a scraping headache, upgrading is the most direct way to keep it moving forward.



What's next — and what would you like to see?

Development is very much ongoing. On the list: a dedicated permissions group so the add-on's settings are easier to find, automatic updating of the datacenter ranges, one-click whitelisting straight from the radar, and more.

But here's the thing — the best features in this add-on came from users, not from me. Datacenter detection exists because someone described a scraping problem I couldn't solve with the tools available. The Cloudflare support exists because a user pointed out their IPs were all showing as the proxy. Several fixes came from people who took the time to write a detailed bug report instead of just uninstalling.

So please: tell me what you need. What's hitting your board that you can't stop? What number do you wish the dashboard showed? What's clunky? Post in this thread — I read everything, and it genuinely shapes what gets built next.

Thanks for using it, thanks for the feedback, and thanks to everyone who has supported the project with a licence. 🛡️
 
Supergatto updated Advanced Traffic Statistics: Access Counter, Live Radar, WAF & Bot Defense with a new update entry:

Advanced Traffic Statistics 1.9.6 — Intrusion Forensics

Your forum is being probed. Not occasionally — every single day. Automated scanners look for exposed configuration files, forgotten backups, admin panels and known vulnerabilities, and until now none of that was visible to you.

This release adds a complete forensic layer that records every intrusion attempt, classifies it, and shows you exactly what the attacker was looking for.



🕵️ Intrusion Attempts — the new forensic panel

Every malicious request is now...

Read the rest of this update entry...
 
Supergatto updated Advanced Traffic Statistics: Access Counter, Live Radar, WAF & Bot Defense with a new update entry:

Advanced Traffic Statistics 1.9.7 — Accurate trends, one-click whitelist & a dashboard that breathes

This release fixes the trend indicators so they finally tell the truth, adds a one-click way to rescue false positives, and gives the dashboard a live pulse that reflects what is actually happening on your board.



📈 Trend indicators corrected

The percentage badges introduced in 1.9.5 were comparing incomplete periods against complete ones: at 2am your "visitors today" was being measured against a full day of yesterday, and on the 1st of the month a few hours...

Read the rest of this update entry...
 
Coming tomorrow: your forum will start explaining itself to you 🤖

The next release lands tomorrow, and instead of listing what changed I'd rather show you what it does — because this one is hard to describe and obvious to see.

Every morning the add-on already publishes an AI-generated security report on your board. Until now that report described your traffic. From tomorrow it interprets it: it knows what the intrusion attempts were looking for, whether they matter for your specific setup, and — most importantly — when you can safely ignore them.

Here is this morning's report from my own board, unedited. It was generated in Italian because my forum is Italian; I've translated it for this post, and yours will arrive in your own language automatically.



Daily Forum Security Report — Radar AI

1. Web traffic summary (last 24 hours)

Traffic on the forum has been active and well managed over the last 24 hours. We recorded high user participation and effective protection against a significant volume of malicious attempts, which were promptly blocked by our security systems.

2. Key metrics
Human requests: 62,103 · Valid bot requests (search engines etc.): 5,051 · Malicious requests blocked: 1,925 · Datacenter IP addresses detected: 210, with the main providers being Tencent Cloud, DataCamp, Huawei Cloud, Clouvider and M247 — networks commonly associated with bot traffic and scanning.

3. Threat and intrusion analysis

Our security systems successfully blocked 1,925 malicious requests. The most persistent sources were two datacenter bots and MJ12bot, ranging from 48 to 107 hits each.

Intrusion attempts: 47 scanning attempts were detected in total, from 14 unique source addresses.

Most frequently targeted paths (representative sample):

Backdoor hunting (opportunism):
/shell.php (3 attempts) · /alfa-rex.php (1 attempt)
These target the discovery of web shells or remote management scripts, suggesting the attackers are looking for sites already compromised by third parties in order to reuse the access. They are not XenForo-specific and were unsuccessful.

Generic scans for other CMS platforms (harmless background noise):
/wp-content/plugins/hellopress/wp_filemanager.php (3) · /wp-includes/fonts/ (2) · /wp-content/themes/seotheme/db.php (2) · /wp-content/themes/index.php · /wp-includes/css/dist/ · /cgi-binwp.php · /wp-includes/l10n/ · /css/wp-login.php · /wp-includes/assets/ · /wp-content/uploads/xxw.php · /wp-admin/css/colors/sunrise/ · /wp-includes/Text/Diff/Engine/file_cdd9.php · /wp-admin/css/colors/midnight/about.php

All paths in this category are specific to WordPress installations. Since our forum runs XenForo exclusively, these attempts are harmless background noise and pose no real threat to our platform. No attempts against known XenForo vulnerabilities or sensitive configuration exposure (.env or .git files) were detected.

Recent connections (sample of the last 200): The sample shows global traffic from a variety of countries. Several blocked bots appear, including multiple instances of HeadlessChrome, Datacenter Bot and a spoofed ChatGPT-User from Italy. Notably, none of the addresses listed among the main blocked threats appears in this sample as unblocked traffic, indicating effective prevention. No suspicious patterns or anomalous activity from non-bot users were observed.

Intrusion verdict: The intrusion activity falls within the normal background scanning that every website receives. There is no indication of attacks specifically targeting our XenForo platform, nor attempts to expose sensitive configuration.

4. Conclusion
Forum security remains solid and well monitored. Our defence systems handled every threat and intrusion attempt detected in the last 24 hours. No immediate action is required.



Why this is different from a list of numbers

Notice what the report does there. It doesn't just say "47 scans detected" and leave you wondering. It separates three completely different intentions hiding behind similar-looking paths:

Someone sweeping for WordPress logins is firing the same list at millions of addresses without checking what any of them run. Harmless here — and the report says so plainly instead of alarming you.

Someone requesting /shell.php or /alfa-rex.php is doing something else entirely: those files are web shells, the control panels attackers leave behind after breaking into a site. They aren't trying to break in — they're looking for a site someone else already broke into, hoping to reuse the access. That tells you the attacker is opportunistic rather than interested in you specifically.

And someone requesting /.env is after credentials and API keys accidentally left readable, which is the one category where a single success is serious.

Three identical-looking lines in a log, three completely different meanings. That distinction is what turns a wall of data into something you can act on — or safely ignore, which is half the value.

Accuracy safeguard

One detail worth mentioning, because it caught me out while building this. Plenty of forums run a WordPress blog on the same domain. For them, those /wp-login.php probes are not harmless noise — they're attempts against a real installation. A report that reassures you while you're actually under attack is worse than no report at all.

So the release adds a setting where you declare what else runs on your domain. Leave it empty and the report treats other-CMS probes as noise; fill it in and the same probes get reported as genuine attempts against a real target.

Also coming

The report language is now detected from your board automatically — no configuration needed. There's a field for your own instructions, if you want the report to focus on what matters to your community. And the manual "generate analysis" button gets the same intelligence, with internal application traffic filtered out so the page list actually tells you something.



Over to you

Two things I'd genuinely like to hear before and after you update.

What is your board seeing? Post the interesting bits of your report — the paths being targeted, anything odd. I'm curious whether the patterns differ across communities, and it helps me tune the detection.

What would you want it to tell you? The reporting is only as good as the questions it answers. If there's something you check manually every morning that the report could do for you, say so — several features in this add-on exist because someone described a problem in this thread.

Release lands tomorrow. 🛡️
 
Supergatto updated Advanced Traffic Statistics: Access Counter, Live Radar, WAF & Bot Defense with a new update entry:

Advanced Traffic Statistics 1.9.8 — The AI report now interprets, not just reports

The daily security report has always told you what happened on your board. From this release it tells you what it means — and, just as importantly, when you can safely ignore it.



🧠 Intrusion intelligence in the daily report

The AI report now receives the full intrusion picture: attempts grouped by category, the paths that were targeted, and how many distinct sources were involved — alongside the datacenter figures added previously.

More...

Read the rest of this update entry...
 
Back
Top Bottom