XF Bot Guard 1.4.1

[zeeb0t]

That world map doesn't work here, also got an error:


@zeeb0t How can I debug this?

The map requires IP to country resolving, and that issue is directly why it is not resolving IP to country. There will be an update coming in the next few hours which replaces the existing IP to country update process and should directly also resolve this issue for you by superseding that current implementation around it.

 

[Faust]

I think using this add-on fills the database? Just a question.

 

[MattW]

One thing I've noticed recently, and this addon has also confirmed it on another site:



Bots are hitting the style-variation links hard, and just generating random crap in the strings.

98.201.240.130 - - [25/Jun/2026:00:56:36 +0100] "GET /misc/style-variation?t=1780085893%2C86c58c048fd59f6a80e14cef32130f7b&variation=default HTTP/2.0" 200 1316 "https://www.gardenerscorner.co.uk" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0"
154.216.207.92 - - [25/Jun/2026:00:56:36 +0100] "POST /bot-guard/collect HTTP/2.0" 400 55 "https://www.gardenerscorner.co.uk/misc/style-variation?reset=1&t=1782120372%2Cc7a6e6dd8ce36c36213dceb6d2b50a57" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
38.162.142.40 - - [25/Jun/2026:00:56:36 +0100] "GET /misc/style-variation?t=1782056205%2C7f98708889bf989c44577473c933cad2&variation=alternate HTTP/2.0" 200 1310 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
46.126.169.125 - - [25/Jun/2026:00:56:36 +0100] "GET /misc/style-variation?t=1779980015%2C15fabb74cb5618ea7cf9388e25a893bf&variation=alternate HTTP/2.0" 200 1313 "https://www.gardenerscorner.co.uk" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0"
212.97.182.243 - - [25/Jun/2026:00:56:36 +0100] "GET /misc/style-variation?t=1780064317%2Cdd819c54c14ba7e9180bafb81f7b6bf0&variation=default HTTP/2.0" 200 1314 "https://www.gardenerscorner.co.uk" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36"
2001:569:5b84:5900:d486:183d:1fc4:ef0d - - [25/Jun/2026:00:56:36 +0100] "GET /misc/style-variation?reset=1&t=1781963793%2C7fd9c31722349b167f200c6c13f8e4e3 HTTP/2.0" 200 1309 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
5.90.58.36 - - [25/Jun/2026:00:56:36 +0100] "GET /misc/style-variation?reset=1&t=1780004361%2C171a0b0cf1a85c877d793e99e8050e0a HTTP/2.0" 200 1307 "https://www.gardenerscorner.co.uk" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
177.37.92.64 - - [25/Jun/2026:00:56:37 +0100] "GET /misc/style-variation?reset=1&t=1779923775%2C745dfd10050e2d614c10864487a05d2e HTTP/2.0" 200 1314 "https://www.gardenerscorner.co.uk" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0"
94.205.18.66 - - [25/Jun/2026:00:56:37 +0100] "GET /misc/style-variation?reset=1&t=1780063693%2C2a0026c68813b70d063daa10be593c3d HTTP/2.0" 200 1308 "https://www.gardenerscorner.co.uk" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36"
2001:818:c996:3700:d155:61f3:7f38:8a7d - - [25/Jun/2026:00:56:37 +0100] "GET /misc/style-variation?t=1779967739%2C6fd15ccead78f7d7e269b4dbcb6b7354&variation=default HTTP/2.0" 200 1318 "https://www.gardenerscorner.co.uk" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0"
77.137.71.10 - - [25/Jun/2026:00:56:37 +0100] "GET /misc/style-variation?t=1779938830%2Cf9d944653923e07eed130ea85520d01d&variation=alternate HTTP/2.0" 200 1309 "https://www.gardenerscorner.co.uk" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0"
185.184.198.6 - - [25/Jun/2026:00:56:37 +0100] "GET /misc/style-variation?reset=1&t=1780059412%2Cc2225556230b7144b5d8b88145b569c0 HTTP/2.0" 200 1313 "https://www.gardenerscorner.co.uk" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
94.204.232.91 - - [25/Jun/2026:00:56:37 +0100] "GET /misc/style-variation?t=1780051607%2C93b96d4b518e87ccdbb0d2ea5324f66f&variation=default HTTP/2.0" 200 1318 "https://www.gardenerscorner.co.uk" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
139.135.139.82 - - [25/Jun/2026:00:56:37 +0100] "GET /misc/style-variation?t=1780014786%2C4b1a88a0e9da1db81a2f1edcdac27bce&variation=alternate HTTP/2.0" 200 1315 "https://www.gardenerscorner.co.uk" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36"
103.191.119.137 - - [25/Jun/2026:00:56:37 +0100] "GET /misc/style-variation?reset=1&t=1780063406%2C178fc967553120dccb9c9c9b6902d4f3 HTTP/2.0" 200 1309 "https://www.gardenerscorner.co.uk" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0"
89.42.71.23 - - [25/Jun/2026:00:56:37 +0100] "GET /misc/style-variation?reset=1&t=1782100002%2Cddfc6b786ee673bc62bae38892783afc HTTP/2.0" 200 1307 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
188.199.230.64 - - [25/Jun/2026:00:56:37 +0100] "GET /misc/style-variation?t=1782116050%2C17a6d60055a9f1c6c4c6d07f9c0d0b22&variation=alternate HTTP/2.0" 200 1315 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
189.203.133.100 - - [25/Jun/2026:00:56:37 +0100] "GET /misc/style-variation?t=1782083927%2Cad46f57032f9e96a63a3f133edda577d&variation=default HTTP/2.0" 200 1312 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.3"

 

[Faust]

Just tested. This addon massively increases the database quota. Had to get rid of it.

 

[zeeb0t]

I think using this add-on fills the database? Just a question.

Yes it uses the database. You can control all the retention settings within the options.

Just tested. This addon massively increases the database quota. Had to get rid of it.

As above, you can control retention, and it also leverages the XenForo cache where available in an attempt to limit DB read path.

 

[smallwheels]

I think using this add-on fills the database? Just a question.

Just tested. This addon massively increases the database quota. Had to get rid of it.

Pretty quick test, with just 30 mins between the two posts. Yes, this add on is pretty db-heavy, but how heavy it is depends to a degree from how you configure it (what is logged and for how long is the data kept). Plus obviously from the amount of traffic that is processed. If it is your first and only barrier to the outside world this add on may be not the best idea when you have a limit on db size. On the other hand it is very useful - properly configuring it and having a first barrier before it lowers the issue.

 

[smallwheels]

The map requires IP to country resolving, and that issue is directly why it is not resolving IP to country. There will be an update coming in the next few hours which replaces the existing IP to country update process and should directly also resolve this issue for you by superseding that current implementation around it.

That's a good direction. Basically, the country resolving is a phonebook that is dynamically changing - so rather dynamic data that needs to be relatively frequently updated, in opposite to configuration data or application code that may reach a level of stability at one point. The approach currently used equals DNS in early times of the net when the textfiles resolving hostnames to IPs hat to be copied over manually from server to server as DNS as we know it was not invented yet. Turned out that this was suboptimal pretty quickly.

 

[zeeb0t]

Bots are hitting the style-variation links hard, and just generating random crap in the strings.

Those bots are confused and hitting an AJAX/JSON type endpoint as a standard GET resource, it seems. Odd behaviour and an odd route to have to protect, but, the way those bots are trying to use it - becomes a valid protection path and they get found out.

 

[zeeb0t]

That's a good direction.

The new approach will essentially ensure the mmdb files keep up to date with the vendor itself - so always updated within 24 hr or so. And won't ship within the add-on ZIP itself.

 

[Anthony Parsons]

Have you looked at how to improve its performance, similar to issues XTR Threat Monitor went through: https://xenforo.com/community/resources/xtr-ip-threat-monitor.10134/updates#resource-update-51744

It was crashing memory and CPU... refining got there in the end though.

 

[zeeb0t]

It was crashing memory and CPU... refining got there in the end though.

I am not suggesting the add-on is perfectly optimised. Performance is something I review routinely and continue to improve where possible.

It does use the database, and that is by design. Bot Guard is not intended to be a blunt firewall-style tool that simply blocks traffic based on IPs. That distinction is made clear in the resource description and documentation.

e.g., from the resource page:

XF Bot Guard is not DDoS protection, not a replacement for good hosting or upstream mitigation, and not a promise that every bot will be stopped.

If a site is already being heavily inundated with bots to the point that server resources are stretched, then it may not be practical to rely on Bot Guard as the first or only layer of defence. In those situations, more blunt-force measures should be taken first where possible, such as blocking abusive ASNs, IP ranges, or traffic patterns at the firewall or edge layer.

Alternatively, the site needs to have sufficient resources available for Bot Guard to operate effectively while it analyses and responds to the traffic.

What I do not claim, and have never claimed, is that Bot Guard is a replacement for edge protection, firewall rules, or broader server-level mitigation. It is designed to be part of a layered defence strategy, not a substitute for every other layer.

 

[Anthony Parsons]

I'm not saying that, I'm saying have you looked at all the available options to improve its performance? Threat Monitor suffered similar performance issues (i linked to them), especially on larger sites, it was crashing memory and cpu. After looking at things a different way, the dev streamlined it and refined its performance to no longer do any of that, whilst operating as intended.

 

[zeeb0t]

I'm saying have you looked at all the available options to improve its performance?

I think I answered this. All available options? Perfect? Well, no. Constantly reviewed, improved, or optimised over time? Yes. But this add-on, frankly, does a lot more than a blunt IP/ASN based blocking. So, respectfully, it's not in the same league of comparison. Even though I get and appreciate what you are saying. I guess all I can say is, understand - agree - yes - and the job and commitment is far from done in many respects... as you can see by my update history.

 

[zeeb0t]

I'm not saying that, I'm saying have you looked at all the available options to improve its performance? Threat Monitor suffered similar performance issues (i linked to them), especially on larger sites, it was crashing memory and cpu. After looking at things a different way, the dev streamlined it and refined its performance to no longer do any of that, whilst operating as intended.

p.s., if it helps - I am working on a running mode which runs only in XenForo defined cache - no DB. There will be limited to no transactional event log, limited dashboard snapshots, not all features available - but completely frees the DB from the hot path. This will be an option for those who have limited resources but few options, so they can start trying to reclaim resources from bots and maybe turn on the full suite some day.

This won't be in the next release, though. But coming.

 

[zeeb0t]

zeeb0t updated XF Bot Guard with a new update entry:

Minor Release: v1.3.5

XF Bot Guard 1.3.5

Release type: minor

Runtime-managed local IP country/ASN databases

XF Bot Guard now manages the local IPLocate country and ASN databases as downloaded runtime resources instead of bundled package files. The add-on can refresh these databases through its MMDB refresh cron, store them under XenForo internal data, validate downloaded files before use, and continue using the previous known-good files if a refresh fails. This keeps local geo/ASN...

Read the rest of this update entry...

 

[zeeb0t]

The add-on is now back to being <2mb in size. IP to country/ASN databases are installed and refreshed automatically by polling my server, and, IPv4-only server issues should now resolved. Enjoy

 

[Rhody]

Has this been tested with the new XF 2.3.11 ?

I am planning to upgrade my forums this weekend, and want to make sure it is safe to do so

Thanks

 

[Faust]

Yes it uses the database. You can control all the retention settings within the options.



As above, you can control retention, and it also leverages the XenForo cache where available in an attempt to limit DB read path.

Will give it an other test, I wasn’t aware about that.

 

[zeeb0t]

Has this been tested with the new XF 2.3.11 ?

I am planning to upgrade my forums this weekend, and want to make sure it is safe to do so

Thanks

Have not tested with 2.3.11 yet. Will be a weekend regression task.

 

[Faust]

What are the addons table in database? as I have to manually remove them to make room in order to upload back to my server.