XF Bot Guard 1.4.1

[zeeb0t]

Validating browser...
This should only take a moment

Is it possible to show this only to bots after detection and not to real users?
Kind regards ,
Alex

Not exactly. The “Validating browser...” page is shown before Bot Guard has enough browser proof to fully assess a fresh visitor. It is deliberately a pre-validation step, not a bot-only page shown after detection.

You can disable it by turning off “Run browser validation bootstrap before challenging fresh visitors” in the XF Bot Guard options. After that, fresh visitors will not see this lightweight validation interstitial first.

The important trade-off is that protected content may be served before the browser proof collector has run. Bot Guard can still use server-side scoring and challenge suspicious requests, but simple no-JS crawlers may already receive the page they requested before Bot Guard can collect browser proof. For that reason I recommend leaving this enabled on areas where scraping protection matters most.

If the concern is wording or presentation rather than the validation itself, you can also change the title, heading and message options for that page.

 

[zeeb0t]

Yes, I'm still getting errors when checking for upgrades to XenForo. I'm going to submit a ticket to XenForo to see if it's an issue with them. It's not Bot Guard, it's been fine checking for updates recently until today

Yep, definitely the right call. Send me a DM if they need any info about XF Bot Guard... but I am almost certain the mention of Bot Guard is unrelated.

 

[zeeb0t]

IETF draft:

https://datatracker.ietf.org/doc/html/draft-meunier-web-bot-auth-architecture

So, I looked into this. The good news is, I am confident I can implement this into XF Bot Guard. It would work "similar" to how rDNS field works - users would enter the domains (representing the crawlers they want to allow) and Bot Guard could use the approach to verify.

That said, from my research - since the draft is, well, draft - but also new (March 2026) it seems the adoption footprint is near minimal for implementation. So, I have added to the backlog, but, not a "do it today" item - as at present time, it would seem it would provide only marginal benefit at best.

That will change quickly, though. So I am going to routinely reassess the priority and adopt when it counts!

 

[Rhody]

You are amazing. Thanks for all of your hard work!

 

[zeeb0t]

zeeb0t updated XF Bot Guard with a new update entry:

Minor Release: v1.2.6

XF Bot Guard 1.2.6

Important upgrade notice for Cloudflare / trusted proxy customers: Before upgrading, please review the upgrade notes and ensure the existing Origin lockdown acknowledged for trusted proxy signals option is correctly set where applicable.

Release type: Minor feature release

This release adds a new Quick settings workflow to make XF Bot Guard easier to configure safely, especially for first rollout, normal production use, active bot...

Read the rest of this update entry...

 

[zeeb0t]

You are amazing. Thanks for all of your hard work!

You're welcome!

 

[Chromaniac]

a link to full settings from the left sidebar would be nice to have lol.

lol. nm. it's there now in this update it seems.

 

[zeeb0t]

a link to full settings from the left sidebar would be nice to have lol.

lol. nm. it's there now in this update it seems.

yep, it's there. Moved it all into the left-hand nav. The options/links are becoming too numbered for the add-on only links. Dedicated nav, it is!

 

[smallwheels]

That said, from my research - since the draft is, well, draft - but also new (March 2026) it seems the adoption footprint is near minimal for implementation. So, I have added to the backlog, but, not a "do it today" item - as at present time, it would seem it would provide only marginal benefit at best.

Another paper that might be worth looking at is this one:

Shy Guys: A Light-Weight Approach to Detecting Robots on Websites

arxiv.org

It is even more conceptional, but offers a lightweight approach that can easily be combined with other methods. Their conclusion:

In this paper, we presented a lightweight, passive approach to bot detection that combines user-agent coherence analysis with favicon-based heuristics. Unlike active techniques such as JavaScript challenges or CAPTCHAs, our method operates entirely on standard web server logs and requires no client-side interaction, preserving the user experience for legitimate visitors.
Our evaluation of over 4.6 million requests demonstrates that the proposed method detects 67.6% of bot traffic while maintaining a false-positive rate of only 3.0%. These results indicate that a large proportion of active crawlers deliberately spoof or omit identifying information in their user-agent strings and that checks are necessary to surface them.

No idea if it is worth playing with the method but the paper is short enough to digest it quickly.

 

[zeeb0t]

Another paper that might be worth looking at is this one:

Shy Guys: A Light-Weight Approach to Detecting Robots on Websites

arxiv.org

It is even more conceptional, but offers a lightweight approach that can easily be combined with other methods. Their conclusion:



No idea if it is worth playing with the method but the paper is short enough to digest it quickly.

Thanks! Heuristics like this and many others exist and will exist in Bot Guard over time, as I continue to build it out.

The server side favicon method on its own is actually pretty unreliable as a safety indicator due to many cache related factors, IMO. It also becomes an expensive asset to track every impression on.

Instead, Bot Guard already measures all assets on the page and what number were rendered, and requires a level of consistency or the threat level increases. This means even cached assets are counted as well as numerous assets on the page.

I'm really looking forward to honey pot traps. That will be one of the next ones coming out soon enough.

 

[azzurro]

Updating from 1.2.5 to 1.2.6 in the browser, it appears to be updating with progressing dots:

Upgrading…
Upgrading XF Bot Guard 1.2.5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

But it's taking an hour so far. May be due to the amount of logs I have? Site is still functional.

In the database processlist I see repeated commands such a select xf_zee_botguard_event INNER JOIN xf_zee_botguard_event_detail (having issues pasting commands in XenForo)

 

[zeeb0t]

Updating from 1.2.5 to 1.2.6 in the browser, it appears to be updating with progressing dots:

Upgrading…
Upgrading XF Bot Guard 1.2.5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

But it's taking an hour so far. May be due to the amount of logs I have? Site is still functional.

In the database processlist I see repeated commands such a select xf_zee_botguard_event INNER JOIN xf_zee_botguard_event_detail (having issues pasting commands in XenForo)

Please let it run. It is indexing a state table. It will finish, and the fact you see the query running implies it is not stuck. Its an upgrade / one time event only.

 

[Rhody]

Just had the following error in my admin panel which shows Bot Guard:

I did a manual check for upgrade for XenForo via the admin panel after this error, and it failed, possibly an XenForo server issue?

I received this for the first time today, too, with "just a moment". I don't know how often it checks, but I put Cloudflare up on Monday night. (2 1/2 days ago)

Server error log​

XenForo upgrade check failed: Unexpected result, starting '<!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Typ' // json_decode error: Syntax error

#0 src/XF/Service/Upgrade/CheckerService.php(98): GuzzleHttp\Utils::jsonDecode('<!DOCTYPE html>...', true)
#1 src/XF/Job/UpgradeCheck.php(37): XF\Service\Upgrade\CheckerService->check()
#2 src/XF/Job/UpgradeCheck.php(12): XF\Job\UpgradeCheck->performUpgradeCheck()
#3 src/XF/Job/Manager.php(275): XF\Job\UpgradeCheck->run(6.98915)
#4 src/XF/Job/Manager.php(205): XF\Job\Manager->runJobInternal(Array, 6.98915)
#5 src/XF/Job/Manager.php(89): XF\Job\Manager->runJobEntry(Array, 6.98915)
#6 job.php(46): XF\Job\Manager->runQueue(false, 8)
#7 {main}

Oddly, it says that it last checked Tuesday night, with success. A manual check works fine.

Upgrade check​

Your version of XenForo and official add-ons are fully up-to-date. No issues were identified with your license.
Last upgrade check: Tuesday at 3:55 PM

 

[zeeb0t]

I received this for the first time today, too, with "just a moment". I don't know how often it checks, but I put Cloudflare up on Monday night. (2 1/2 days ago)




Oddly, it says that it last checked Tuesday night, with success. A manual check works fine.

The other day, I was browsing XenForo website and was randomly getting Cloudflare interstitials. Which is exactly what this is showing in part of the HTML output. Bot Guard has its own interstitial, hence, I am pointing toward Cloudflare / XenForo side... and of course, having experienced it first hand.

My guess? Their Cloudflare is slightly misconfigured, or was at the time, at least... maybe still is, all depends on their rules.

 

[Rhody]

Yea it didn't seem to be a big deal, and worked the night before.

I am on day 2 1/2 with no big bot surges over 17k getting through, and no sql crashes. Between XF Bot Guard and Cloudflare working together, the server is happy. Thanks for that!

 

[zeeb0t]

P.S. The next version, 1.2.7, is currently being tested on my live forum and should be coming soon.

Planned additions include:

• Optional, default-off native support for social media unfurling - including WhatsApp - so previews can see and unfurl pages without exposing all of the page content itself.
  
  
• ASN support for existing IP/CIDR excludes - allowing exclusions to be managed by ASN as well as individual IPs or CIDR ranges.
  
  
• ASN/IP/CIDR challenge targeting - allowing Bot Guard to specifically challenge certain IPs, CIDR ranges, or ASNs.
  
  
• Dashboard counts for fake search engine visitors - showing how many visitors claimed to be major search engines but were caught out by Bot Guard.
  
  
• Optional observation-only mode - allowing new users to see what Bot Guard would have done, without actually taking action.

A note on observation-only mode: it will not run the interstitial browser validation, which is an important part of Bot Guard’s suspicion and detection framework. So while it cannot be a perfect dry run, it is the closest practical option for testing Bot Guard’s decisions without making any visitor-impacting changes before going live.

 

[zeeb0t]

Yea it didn't seem to be a big deal, and worked the night before.

I am on day 2 1/2 with no big bot surges over 17k getting through, and no sql crashes. Between XF Bot Guard and Cloudflare working together, the server is happy. Thanks for that!

Love to hear it! Thank you.

 

[lazy llama]

I received this for the first time today, too, with "just a moment". I don't know how often it checks, but I put Cloudflare up on Monday night. (2 1/2 days ago)


Oddly, it says that it last checked Tuesday night, with success. A manual check works fine.

I've also had that error this morning - and I don't have this add-on installed, so I suspect it's something at the XenForo end.

 

[zeeb0t]

I've also had that error this morning - and I don't have this add-on installed, so I suspect it's something at the XenForo end.

That's actually super helpful, thank you.

 

[lazy llama]

That's actually super helpful, thank you.

I've raised a bug report for it - https://xenforo.com/community/threa...-en-us-head-title-just-a-moment-title.238243/