What I think is missing from XenForo today

[benjamincarmel]

I had AI summarize a list of the things I believe are missing and needed in the next release of XenForo. I hope the XF Team starts making regular updates a thing for paying customers otherwise what is the value proposition.


1. PHP & Core Architecture Modernization

• Native PHP 8.2/8.3+ Type System & Enums: Transition core XF\Mvc\Entity and Service classes away from docblock-only typing toward declare(strict_types=1);, native union/intersection return types, readonly properties, and Backed Enums for entity states (visible, moderated, deleted) instead of magic strings.
• Native PHP Attributes for Add-on Development: Allow developers to register class extensions, event listeners, routes, and permissions using native PHP 8 #[Attributes] directly in classes rather than clicking through the ACP Development UI for every single hook.
• Persistent CLI Queue Worker (xf:jobs-worker): Move beyond cron/page-trigger job execution by providing an official long-running CLI worker daemon (compatible with Supervisor/systemd and Redis) for instant background processing of emails, webhooks, and search indexing.
• First-Party Image Optimization (AVIF & libvips): Follow up on 2.3’s WebP support with native AVIF encoding and optional libvips support to drastically cut memory spikes during large image uploads compared to GD/Imagick.

2. Security & Privacy Hardening

• Strict Nonce-Based Content Security Policy (CSP): Provide a native ACP toggle to generate per-request cryptographic nonces for all <xf:js> and inline template scripts so admins can deploy a strict CSP without unsafe-inline.
• Argon2id Default & Hashed Tokens at Rest: Default new installations (and seamlessly rehash on login) to Argon2id where supported by PHP, and ensure all REST API keys, OAuth tokens, and remember-me cookies are stored as SHA-256 hashes in the database rather than plaintext/reversible strings.
• Passkey-Only / Enforced 2FA Per User Group: Upgrade WebAuthn support so admins can require phishing-resistant MFA (Passkeys/Hardware keys only, disabling email OTP fallback) for staff and sensitive user groups.
• Native Attachment EXIF/Metadata Scrubber: Automatically strip GPS coordinates and camera serial EXIF metadata at the byte level on upload (even when image resizing isn't triggered) to protect user privacy.
• Subresource Integrity (SRI) & Local Asset Bundling: Automatically generate integrity hashes for all external scripts/styles and remove remaining hard dependencies on third-party CDNs for privacy compliance.

3. Discourse Feature Parity & Community UX

• Automated "Trust Level" System (TL0–TL4): XenForo’s User Group Promotions are static and cumbersome compared to Discourse’s Trust Levels. Add a native progression engine that tracks time read, posts read, and flags received—automatically lifting link/media restrictions for vetted new users and granting self-moderation tools (like thread retitling or tag editing) to trusted regulars.
• Collaborative "Wiki" Posts: Allow the first post of any thread (or designated thread type) to be marked as a "Community Wiki," permitting users above a specific permission/trust threshold to collaboratively edit it with a full side-by-side revision history and rollback log.
• Native Real-Time Updates via SSE (Server-Sent Events): Without requiring a heavy Node.js setup, implement lightweight HTTP/2 Server-Sent Events (or optional WebSocket broadcasting) to show real-time "User X is replying..." indicators, live alert counters, and instant new-post notifications inside active threads.
• Topic Timers & Automated Thread Lifecycle: Give moderators and OPs native "Topic Timers" on threads—e.g., Auto-close after X days, Auto-close X hours after the last reply, Auto-bump, or Auto-delete/archive on a specific date.
• Interactive Thread Minimap & Summarize This Thread: For megathreads (50+ pages), add a Discourse-style vertical timeline scrubber alongside a "Summarize Thread" filter that dynamically collapses the thread view down to only the highest-reacted/most-quoted posts so latecomers can catch up in 2 minutes.
• Split/Branch Reply into New Thread (With Backlinks): Make it a single-click inline action for moderators (or users replying to a tangent) to "Reply as Linked Thread," automatically cross-linking the original post and the newly branched thread so off-topic derails are cleanly redirected.

 

[smallwheels]

I had AI summarize a list of the things I believe are missing

The last thing this forum is missing are posts made of AI slop. Forums are for communcation between humans. The text you posted is completely unreadable and typical AI slop that you seem not even to have bothered to read through yourself before posting. Do you honestly expect someone to read this and even answer to it?

 

[Taylor J]

I mean it is readable, and also understandable from a engineers eyes, but yes AI slop that wasn't even read enough to notice they posted the LLM's response and also the "BBCode copy and pasteable portion" so it's double written.

 

[smallwheels]

also understandable from a engineers eyes

He does not give any reasoning why he wants these things but simply states that he wants them. There's the "suggestions" forum for this kind of stuff, one suggestion per idea, to make things somewhat organized, discussable and workable with. But no: One post in a completly different area, no reasoning, just "I want that" and he seems the AI have directly wired to his brain, too when he thinks and the AI writes down his thoughts.

He does not ask for feedback or what others think - just spitting out "I want that".

Complete ignorance of release cycles, to:

the things I believe are missing and needed in the next release of XenForo.

I massively doubt that anyone would be willing to put all that stuff into the "next" release of XF (which would be either 2.4 or 2.3.14) given the current timeline and developments. And possibly not in 3.0, too, given what it is intended to deliver.

Then he is even too lazy to at least proof read what the AI wrote. Honestly: Obviously he is running a forum himself, given that he talks about a forum software. As often, I am again pretty baffled how people that run a forum themselves don't get the most elementary principles of forum posts.

 

[briansol]

A big portion of this list are sever limitations. XF is designed to work 'most' places, no the most 'cutting edge' places in order to server more customer's need on shared hosting/etc.

 

[benjamincarmel]

A big portion of this list are sever limitations. XF is designed to work 'most' places, no the most 'cutting edge' places in order to server more customer's need on shared hosting/etc.

Most of these aren’t limited at all by server; these are base technologies and standards that can be implemented in PHP. In fact a great deal just requires modernizing the existing PHP code which still uses outdated PHP conventions.

 

[benjamincarmel]

The last thing this forum is missing are posts made of AI slop. Forums are for communcation between humans. The text you posted is completely unreadable and typical AI slop that you seem not even to have bothered to read through yourself before posting. Do you honestly expect someone to read this and even answer to it?

My guy, AI is used by news media, software companies, and many open-source projects, including the Linux Kernel and PHP Project. If you have an issue with AI use, that concern, although valid, is misplaced here.

 

[Max Taxable]

Nobody's going to read that typically overly verbose wall of text. Learn to instruct the AI to use BREVITY.

 

[smallwheels]

If you have an issue with AI use, that concern, although valid, is misplaced here.

I don't have an issue with people using AI. I simply dislike people using AI as an excuse for lazyness, rudeness and bad behavior. You have joined this forum just today. The first thing you do is to post a wall of AI slop that you did not even proof read in an inadequate manner into the wrong corner of this forum. Do you really expect to get praise for that?