XF Bot Guard 1.4.1

XF Bot Guard protects public XenForo pages from abusive bots, scrapers, fake browsers, crawler abuse, and bot-driven server load.

It is built for the traffic normal anti-spam tools often miss: bots that do not register, do not post, ignore robots.txt, hammer thread/forum pages, inflate online counts, pretend to be real browsers, or claim to be Googlebot/Bingbot without actually verifying.

XF Bot Guard validates real browsers, scores suspicious behaviour, challenges risky visitors with XenForo CAPTCHA, allows verified crawlers, and gives admins clear logs, dashboards, reason codes, health checks, and optional Cloudflare edge enforcement.

• Scrapers repeatedly loading threads, forums, profiles, search-style pages, and public content
• Fake browser traffic with weak or missing browser proof
• Bots rotating IPs, sessions, fingerprints, countries, or ASNs
• Unverified crawler claims pretending to be trusted bots
• Guest traffic storms creating PHP, database, or session pressure
• Bot activity inflating Members Online and public guest counts

XF Bot Guard is conservative by default.

• Disabled after installation
• Guest-only protection by default
• GET-only challenges by default
• AJAX, admin, login, register, API, webhook, CAPTCHA, static asset, robots.txt, and sitemap-style paths excluded by default
• Hard deny off by default
• Verified crawler allowance on by default
• Cloudflare Edge Enforcement optional and dry-run first
• Observe-only mode available for testing would-actions before enforcement
• Provides a GDPR-compatible operating mode

The intended rollout is simple: install it, run the Health check, fix anything important, start cautiously or in Observe-only, then watch the Dashboard and Raw event log.


XF Bot Guard gives you visibility into what happened and why.

• Dashboard for traffic pressure, challenge activity, crawler activity, route pressure, and risk reasons
• Raw event log with filters and event detail
• Reason codes for challenge decisions
• Health check for setup, cache, CAPTCHA, crawler, Cloudflare, and cleanup state
• Quick settings profiles for cautious rollout, balanced production, active bot storm, SEO-sensitive behaviour, GDPR-compatible operating mode, and Observe-only

XF Bot Guard runs inside XenForo and does not require Cloudflare.

If you do use Cloudflare, optional Edge Enforcement can take high-confidence local abuse signals and push repeat offenders to Cloudflare Managed Challenge before they reach XenForo.


XF Bot Guard does not blindly trust user-agent strings.

Legitimate crawlers can be allowed after verification. Fake crawler claims can still be challenged or logged as suspicious. Selected verified AI search/user-triggered fetchers can be handled separately from broad AI training crawlers.


XF Bot Guard is not DDoS protection, not a replacement for good hosting or upstream mitigation, and not a promise that every bot will be stopped.

Advanced bots can run JavaScript, keep cookies, rotate IPs, use residential proxies, and solve CAPTCHA. XF Bot Guard raises the cost of abuse, reduces easy scraping, and gives admins better control over suspicious public traffic.

• XenForo 2.1, 2.2, or 2.3
• PHP 7.2+
• A usable XenForo-compatible CAPTCHA provider if you want CAPTCHA challenges

Start with the Health check and cautious settings. Review the logs. Tighten only when the signals look clean.

If XF Bot Guard helps your forum, please consider leaving a review. Reviews make a real difference for XenForo add-ons.