Forum Moderators: open
Most caught in the loop were from Singapore posing as Google.
[edited by: thecoalman at 3:45 pm (utc) on Jul 26, 2025]
I have used phpBB for 24 years. In the last few weeks/months I have seen a sharp increase in extreme bot activity. I have blocked all of Singapore, Brazil, and some other countries as needed. I highly recommend you use free Cloudflare to help get the overbearing bot traffic under control. You can use a "managed challenge" on urls like /forums/ucp.php* which helps slow down bots but not turn off too many legit users
Go to Security >> Settings >> Bot traffic and enable "Bot fight mode". This will block some of the most malicious bots Cloudflare has identified. Optionally you can also enable "Block AI Bots" which will block AI scrapers that identify themselves, e.g ChatGPT. Next create some rules. Go to Security >> Security Rules >> Create new Rule >> New Custom Rule. CF as an easy to use interface the following examples are from the expression generated by GUI.
Rules are fired in order so rule 1 is to whitelist with the action skip. This is primarily for bots you want to a have access. CF maintains a list of verified bots that adhere to robots.txt so you can add them. If you want to allow other bots not on that list just add their user agents. (cf.client.bot and http.user_agent wildcard r"Somebot")Rule 2 is for whatever you want to outright block. You can block using a variety of criteria like ASN, User Agent, Country etc. For this example we are blocking the country T1 which is Tor network and the continent of Antarctica. (ip.geoip.country eq "T1" and ip.src.continent eq "AN")For rule 3 we will add a rule for problematic countries and for action will issue an interactive Challenge. The interactive challenge requires the user to perform some action on screen, usually a check box. In the following example it's issued to India and China. (ip.geoip.country eq "IN") or (ip.geoip.country eq "CN")For rule 4 and rule we'll whitelist countries and for action we'll use is JSChallenge which is the brief "Checking your browser..." page. Countries listed here will not be challenged so add your country and countries where you expect the bulk of your traffic from. Any country not listed here and assuming they weren't blocked with any of the rules above will be issued JSChallenge. It's important to note you need to use the "Does not equal" operator with AND. In the following example the US, Canada and the UK are whitelisted. (ip.geoip.country ne "US" and ip.geoip.country ne "CA" and ip.geoip.country eq "GB")
Is there a canon directive in use?
(http.request.uri.path wildcard r"/forums/ucp.php*" and ip.src.country ne "CA" and ip.src.country ne "US") or (http.request.uri.path wildcard r"/forums/posting.php*" and ip.src.country ne "CA" and ip.src.country ne "US") or (http.request.uri.path wildcard r"/forums/search.php*" and ip.src.country ne "CA" and ip.src.country ne "US")
<!-- IF S_IS_BOT -->
Author's Name
<!-- ELSE -->
<a href="link_to_authors_profile.php">Author's Name</a>
<!-- ENDIF -->
<h3 {% if postrow.S_FIRST_ROW %}class="first"{% endif %}>
{% if postrow.POST_ICON_IMG %}
<img src="{{ T_ICONS_PATH }}{{ postrow.POST_ICON_IMG }}" width="{{ postrow.POST_ICON_IMG_WIDTH }}" height="{{ postrow.POST_ICON_IMG_HEIGHT }}" alt="{{ postrow.POST_ICON_IMG_ALT }}" title="{{ postrow.POST_ICON_IMG_ALT }}">
{% endif %}
<a {% if postrow.S_FIRST_UNREAD %}class="first-unread" {% endif %}href="{{ postrow.U_MINI_POST }}">{{ postrow.POST_SUBJECT }}</a>
</h3><!-- IF 0 -->Mod - removed post titles
<h3 {% if postrow.S_FIRST_ROW %}class="first"{% endif %}>
{% if postrow.POST_ICON_IMG %}
<img src="{{ T_ICONS_PATH }}{{ postrow.POST_ICON_IMG }}" width="{{ postrow.POST_ICON_IMG_WIDTH }}" height="{{ postrow.POST_ICON_IMG_HEIGHT }}" alt="{{ postrow.POST_ICON_IMG_ALT }}" title="{{ postrow.POST_ICON_IMG_ALT }}">
{% endif %}
<a {% if postrow.S_FIRST_UNREAD %}class="first-unread" {% endif %}href="{{ postrow.U_MINI_POST }}">{{ postrow.POST_SUBJECT }}</a>
</h3>
<!-- ENDIF -->
