XF 2.3 block misc/style-variation from being accessible to guests and bots/crawlers?

[DarkGizmo]

Is it possible to block guests & crawlers/bots from accessing misc/style-variation?

I see a lot of guests trying to access this, as seen here:


Would it be possible to block access to this URL all together from guests and crawlers/bots and if so, how?

 

[Kirby]

K

Future fix Post in thread 'Google tries to crawl links from style variation chooser menu'

Dec 3, 2025

A less invasive option:

style_variation_macros

<xf:macro name="variation_menu_item"
    arg-routeType="public"
    arg-route="{{ link('misc/style-variation') }}"
    arg-variation="!"
    arg-icon="fa-adjust"
    arg-label=""
    arg-selectedVariation="{$xf.visitor.style_variation}"
    arg-live="{{ false }}"
    arg-redirect="{{ null }}">

    <xf:set var="$tag" value="{{ $live ? 'span' : 'a' }}" />

    <{$tag} class="menu-linkRow {{ $variation === $selectedVariation ? 'is-selected' : '' }}"
        {{ !$live ? 'href="' . link_type($routeType, $route, null, {...

• Kirby

• 

 

[CTS]

If you use at least the free Cloudflare, just set up a security rule to stop a uri request with the string "style-variation".

I had that problem, and this stopped 100% from ever reaching the server. I was getting 1000's a day, now zilch.

I can see at cloudflare it is blocking hundreds a day from hitting my XF instance still.

(edit to add: until which time the fix above is implemented within XF.)

 

[Chromaniac]

Anyone know why this is happening in the first place? Bots go after the style variation page like crazy.

 

[CTS]

View attachment 339020

Anyone know why this is happening in the first place? Bots go after the style variation page like crazy.

I think the BotMaster feels there is a vulnerability to exploit maybe themes that are available and may have flaws in them. But yeah, nothing there for sites like mine that are a one theme pony.

 

[DarkGizmo]

If you use at least the free Cloudflare, just set up a security rule to stop a uri request with the string "style-variation".

I had that problem, and this stopped 100% from ever reaching the server. I was getting 1000's a day, now zilch.

I can see at cloudflare it is blocking hundreds a day from hitting my XF instance still.

(edit to add: until which time the fix above is implemented within XF.)

I tried using a URI contains style-variation, and deployed it, but it also blocks it entirely even for regular users, I don't want that, i just want it blocked from bots/guests.

 

[Chromaniac]

You can use a second condition to check for the xenforo user cookie.

(http.request.uri contains "style-variation" and not http.cookie contains "xf_user")

 

[CTS]

I tried using a URI contains style-variation, and deployed it, but it also blocks it entirely even for regular users, I don't want that, i just want it blocked from bots/guests.

I understand, and it sounds like you have more than one theme available to members. It worked for me as I only have one theme, so access to the chooser for me isnt needed at all.