XF Bot Guard 1.4.1

[Jake B.]

Just a heads up - on XF 2.2 if your device uses dark mode most of the dashboard is completely unreadable. Seems like it's expecting the AdminCP dark mode to kick in, but that doesn't exist on 2.2. Haven't tried it on a site running XenForo 2.3 yet to confirm

 

[Apt Irrelevance]

I am taking a break this weekend

Very nice. It feels like you haven't slept in weeks.

 

[smallwheels]

so ahrefs bots all over the bots page on my board right now. i found the asn (16276) and put it in Forced challenge IPs/CIDRs/ASNs section but that does not seem to do anything and they are still having a free for all buffet? what could i be doing wrong here!

You are using the wrong tool for the job. For a hard lock out of something you can easily and safely identify other tools are better suited. Block the ASN in CF, a firewall or IP Threat Manager. Block the user agent in .htacces (if it identifies properly). Or both.

 

[smallwheels]

Just a heads up - on XF 2.2 if your device uses dark mode most of the dashboard is completely unreadable. Seems like it's expecting the AdminCP dark mode to kick in, but that doesn't exist on 2.2. Haven't tried it on a site running XenForo 2.3 yet to confirm

Darkmode has already been reported as problematic, also with 2.3. Is dark mode officially a feature of 2.2? Don't think so. I'd rather see the energy going into other features than the support for an unofficial configuration of a depreciated XF version, to be honest.

 

[Chromaniac]

You are using the wrong tool for the job. For a hard lock out of something you can easily and safely identify other tools are better suited. Block the ASN in CF, a firewall or IP Threat Manager. Block the user agent in .htacces (if it identifies properly). Or both.

that option is to force specific ips/asns through the challenge. and i am trying to do just that. i assume that ahrefs is part of the whitelisted searchbots? which is why this setting was not working? might be worth considering to make it user selectable? this addon works very well as some sort of a soft firewall. cloudflare has been a mess here in india. it actually slows down your website. i am going to try managing without it for the time being. i cannot use its firewall features without using the proxying feature as well.

 

[zeeb0t]

that option is to force specific ips/asns through the challenge. and i am trying to do just that. i assume that ahrefs is part of the whitelisted searchbots? which is why this setting was not working? might be worth considering to make it user selectable? this addon works very well as some sort of a soft firewall. cloudflare has been a mess here in india. it actually slows down your website. i am going to try managing without it for the time being. i cannot use its firewall features without using the proxying feature as well.

Do you have the Cloudflare trusted bots enabled?

 

[zeeb0t]

my feature request would be to set the times when the database pruning happens. for me for instance server is rather free past midnight. i know the addon already has a lot of features to ensure that database pruning does not take down the server but this seems like a nice option to have maybe?

Nice idea, I have added it to the backlog. Thank you!

 

[Chromaniac]

ooh. i do have Allow verified search crawlers and fetchers enabled.

settings page has become rather long and this option is very far away from the other option where it uses this addon's own database lol.

 

[zeeb0t]

ooh. i do have Allow verified search crawlers and fetchers enabled.

That's what you are "doing wrong" in a sense. It overrides all features in respect of trusting whatever bots Cloudflare trusts, and ahrefs is one of the many it does.

If you want, you can disable that. And then in quick settings click to apply the SEO overlay. This should give you the best sane bot trust imo.

 

[zeeb0t]

Just a heads up - on XF 2.2 if your device uses dark mode most of the dashboard is completely unreadable. Seems like it's expecting the AdminCP dark mode to kick in, but that doesn't exist on 2.2. Haven't tried it on a site running XenForo 2.3 yet to confirm

View attachment 340196

Ah indeed, my dark theme support expects XenForo dark theme to have applied. I'll add this to my baxklog to address.

 

[zeeb0t]

That's what you are "doing wrong" in a sense. It overrides all features in respect of trusting whatever bots Cloudflare trusts, and ahrefs is one of the many it does.

If you want, you can disable that. And then in quick settings click to apply the SEO overlay. This should give you the best sane bot trust imo.

P.s. you wont need to block the asn for ahrefs once this is done. Bot Guard will by default then give them the flick.

 

[Chromaniac]

thanks! i do plan to use this addon as the makeshift solution till i figure out anubis lol.

so i am kind of confused about quick settings. i click preview on 'SEO-sensitive overlay`. it shows me a bunch of things. but there is no turn on option. if i reload the page, it reverts back to original view with nothing selected?

 

[zeeb0t]

Very nice. It feels like you haven't slept in weeks.

To be honest, I am enjoying it. But it doesn't help my kids have been unwell and keeping me awake at all hours. Im also a firefighter and it has been recently busy.

So, no sleep for me. Lol

But, this weekend is dedicated to sleep.

 

[zeeb0t]

thanks! i do plan to use this addon as the makeshift solution till i figure out anubis lol.

On my list of things to do is to put out a version of XF Bot Guard that works for any website and sits upstream of the website itself.

 

[zeeb0t]

so i am kind of confused about quick settings. i click preview on 'SEO-sensitive overlay`. it shows me a bunch of things. but there is no turn on option. if i reload the page, it reverts back to original view with nothing selected?

There should be a button to apply at the bottom once you previewed it. That or its complaining about something in its output.

 

[Chromaniac]

righto. i was not reading the message at the bottom where it directed to clear all the warnings lol. i have turned it on. thanks for all the help!

 

[zeeb0t]

righto. i was not reading the message at the bottom where it directed to clear all the warnings lol. i have turned it on. thanks for all the help!

You're welcome!

 

[zeeb0t]

Just a quick note: the next version will include bundled IP databases, so sites that are not using services such as Cloudflare will still receive IP-to-country and IP-to-ASN data in the hot path, provided directly via Bot Guard itself.

This does increase the add-on package size to around 30 MB.

If you normally upload add-ons via the ACP, you may need to increase your PHP "post_max_size" and "upload_max_filesize" settings to allow for the larger upload. Otherwise, you may need to upload the files manually via FTP or SCP.

 

[Dragonfruit]

Just a suggestion @zeeb0t

A complete blacklist for ASN & IP ranges would be nice to prevent any resource loading, maybe just a simple message like "Your IP has been blacklisted".

 

[zeeb0t]

Just a suggestion @zeeb0t

A complete blacklist for ASN & IP ranges would be nice to prevent any resource loading, maybe just a simple message like "Your IP has been blacklisted".

You mean, like, a hard-deny option? Basically, an option that would treat "Forced challenge IPs/CIDRs/ASNs" and "Additional forced challenge CIDR JSON sources" as targets to drop entirely, not just challege?