XF 2.3 Many guests viewing "XF\Pub\Controller\MiscController::StyleVariation"

[Waterfall]

Hello,

We've had a massive uptick in guests viewing an unknown page, specifically "XF\Pub\Controller\MiscController::StyleVariation". This attack of bots is really hampering us and I'm seeing 10k bots online pretty much all the time. We've already implemented the solution shown in this linked post:

K

Future fix Post in thread 'Google tries to crawl links from style variation chooser menu'

Dec 3, 2025

A less invasive option:

style_variation_macros

<xf:macro name="variation_menu_item"
    arg-routeType="public"
    arg-route="{{ link('misc/style-variation') }}"
    arg-variation="!"
    arg-icon="fa-adjust"
    arg-label=""
    arg-selectedVariation="{$xf.visitor.style_variation}"
    arg-live="{{ false }}"
    arg-redirect="{{ null }}">

    <xf:set var="$tag" value="{{ $live ? 'span' : 'a' }}" />

    <{$tag} class="menu-linkRow {{ $variation === $selectedVariation ? 'is-selected' : '' }}"
        {{ !$live ? 'href="' . link_type($routeType, $route, null, {...

• Kirby

• 

However, I am not 100% sure if that is all that we need to do, or whether that is even the correct solution. Is anyone else experiencing similar that managed to get this under control?

 

[smallwheels]

Is anyone else experiencing similar that managed to get this under control?

There is this thread specifically for this topic:

XF 2.3 Thread 'block misc/style-variation from being accessible to guests and bots/crawlers?'

May 28, 2026

Is it possible to block guests & crawlers/bots from accessing misc/style-variation?

I see a lot of guests trying to access this, as seen here:


Would it be possible to block access to this URL all together from guests and crawlers/bots and if so, how?

• DarkGizmo
• Replies: 7
• Forum: XenForo questions and support

and there is the huge bot fighting thread:

Thread 'Crazy amount of guests'

Oct 12, 2025

I have a small forum, usually a few hundred guests at most. The last days the number of guests have been unusually high, around 3000 and climbing. We now have over 4800 guests. That's not normal. Many "Viewing unknown page" or "Latest content", with a warning sign. IP addresses are from all corners of the world. Many from south America, Brazil mostly. Also saw quite a number from Vietnam of all places, but everywhere else too.

We're on Cloud and I don't know what to do. Could we be under attack? We have been in the past, a few times I think. For reasons I cannot possibly fathom; we're a...

• Levina
• bot swarms guests
• Replies: 1,885
• Forum: Forum management

• 

which you should possibly read, as

I'm seeing 10k bots online pretty much all the time

this has become pretty common and there are many ways to Rome, depending from your goals and situation.

 

[greenchicken]

Hello,

We've had a massive uptick in guests viewing an unknown page, specifically "XF\Pub\Controller\MiscController::StyleVariation". This attack of bots is really hampering us and I'm seeing 10k bots online pretty much all the time. We've already implemented the solution shown in this linked post:

K

Future fix Post in thread 'Google tries to crawl links from style variation chooser menu'

Dec 3, 2025

A less invasive option:

style_variation_macros

<xf:macro name="variation_menu_item"
    arg-routeType="public"
    arg-route="{{ link('misc/style-variation') }}"
    arg-variation="!"
    arg-icon="fa-adjust"
    arg-label=""
    arg-selectedVariation="{$xf.visitor.style_variation}"
    arg-live="{{ false }}"
    arg-redirect="{{ null }}">

    <xf:set var="$tag" value="{{ $live ? 'span' : 'a' }}" />

    <{$tag} class="menu-linkRow {{ $variation === $selectedVariation ? 'is-selected' : '' }}"
        {{ !$live ? 'href="' . link_type($routeType, $route, null, {...

• Kirby

• 

However, I am not 100% sure if that is all that we need to do, or whether that is even the correct solution. Is anyone else experiencing similar that managed to get this under control?

i like this CF expression for that

(http.request.uri contains "/misc/style-variation" or http.request.uri.path contains "/src/" or http.request.uri.path contains "/internal_data/")