Bad Behavior 2.1.6
August 8th, 2010 by Michael Hampton
Bad Behavior version 2.1.6 has been released. It is a development release intended for testing and verification of new functionality and should not normally be used on production sites.
Please note: The 2.0 series of Bad Behavior is receiving limited updates, including unblocks, bug fixes and security fixes only. Future development is taking place in the 2.1 development tree.
Who should upgrade?
Users of the CloudFlare reverse proxy service should upgrade to ensure that legitimate requests are not blocked.
What’s new?
New in this release (since 2.1.5):
- A logic error in the CloudFlare detection code was causing legitimate requests to be intermittently blocked. This issue should be fixed.
What’s coming?
In the next few releases I will be rolling out a significant number of blocks intended to catch a wide variety of malicious robots. These include content scrapers, referrer spammers, automated cracking tools and more. Each of these is going through an extensive review prior to being released, to ensure that legitimate requests are not blocked.
Download
Download the latest development release of Bad Behavior now!
Support
I can only spend time on improving Bad Behavior when incoming donations cover the cost of my time. Otherwise I have to engage in paying work to keep food on my table.
I happen to like giving spammers a hard time, and it’s frustrating that I don’t get to spend enough time on it. You can help me make Bad Behavior even better by setting up a recurring contribution, or making your most generous one-time contribution for any amount.
Thank you again for supporting Bad Behavior development!
Daniel Brooke Peig Says
Just a suggestion,
The file settings.ini could have a PHP extension instead of .INI. This would prevent unauthorized access from the internet (example: http://www.mysite.com/bad-behavior/settings.ini). Some sensitive information like the private httpbl key is exposed.
Excellent software!
Aug 9th, 2010 at 1:43 am
Michael Hampton Says
This is a good idea, though the file really isn’t a PHP file so I’m not sure a .php extension is appropriate. Someone trying to load it would get a PHP fatal error with at least part of the contents. I’ll accept other ideas on extensions that might be used, though.
The best solution here is proper web server security, which is something I can’t really force people to do.
Aug 9th, 2010 at 1:47 am
Jamie Scott Says
Great plugin, use it on my blog.
Another idea
I think it would be nice to be able to include an exclusion list, for if you want to permit access to an specific ip or range of IPs which may have been blocked accidentally by project honeypot.
Just a thought
Sep 10th, 2010 at 1:25 pm
Michael Hampton Says
Jamie, there is already a whitelist.
Sep 10th, 2010 at 4:15 pm