We do a considerable amount of user validation on our phpbb board. It has accomplished a great deal to combat the problem you mentioned. Since it is important that valid SE bots from these three do not have to go through any of that, this tool is helpful at the front end of our validation routines/code. All three change their IP blocks from time to time, so the tool is helpful for keeping track of those ranges automatically - allowing uninterrupted access.phpBB3 already has entry for IP's for the bots but I don't know think they are blocked if there is mismatch between the IP and user agent. Soeone would have to test but I think they just get guest permissions.
It's not enabled here on phpbb.com but Cloudflare will block spoofed user agents with invalid IP's.
I'm not so sure someone spoofing a bots user agent is a big concern. The six gazillion random IP's from bot nets with browser user agents are the concern today.
The concepts in this script can also be a useful starting point for those who wish to take a more vigilant approach to user validation.
We do not use CF as we prefer to minimize third party dependencies.
Statistics: Posted by JLA — Thu Mar 13, 2025 9:27 pm
