Please note: The 2.0 series of Bad Behavior is receiving limited updates, including unblocks, bug fixes and security fixes only. Future development is taking place in the 2.1 development tree.

Who should upgrade?

All users of the 2.0 series should upgrade to prevent leakage of information about your server to spammers and malicious bots.

All users should upgrade to ensure that their placement in the Google search engine remains intact.

What’s new?

New in this release (since 2.0.42 and 2.1.11):

• The 2.0.42 release, and possibly older releases, inadvertently omitted a message intended to be displayed to spammers pretending to be the Yahoo! search engine. Because of this, in non-default server configurations, a PHP notice could appear to the spammer which leaked information about the server. This message has been reinserted and the issue fixed.
• Google is now operating a new IP address range in China, from which it is crawling some Web requests. Interestingly, it is crawling all countries from this Chinese address range. Bad Behavior is now aware of this address range and will no longer block requests from Google which originate in China.

What’s coming?

I’m currently preparing to release the next major stable release of Bad Behavior, version 2.2. This release is sufficiently different that anyone maintaining a port needs to update their port to handle the new features immediately (such changes are backward compatible if implemented properly). Ports which are currently feature-complete on 2.1 will not need updating for 2.2 as the API is now stable.

After that, the next development branch will target version 3.0. As I’ve mentioned before, it’s a complete ground-up rewrite, so anyone maintaining a port will need to track development and be prepared to completely rewrite their ports. It’s going to be a week or two at least before I have alpha code to share, but you will want to make time for it, because there will also be important changes in the way Bad Behavior is distributed. I hope to have 3.0 in beta later this month, and a general release by the end of May.

For our enterprise users who require long-term support, the 2.0 branch will continue to receive long-term support through June 30, 2012, and the 2.2 branch (coming shortly) will be fully supported until the 3.0 release, and then receive long-term support through June 30, 2014.

Download

Download the latest release of Bad Behavior now!

Support

I can only spend time on improving Bad Behavior when incoming donations cover the cost of my time. Otherwise I have to engage in paying work to keep food on my table.

I happen to like giving spammers a hard time, and it’s frustrating that I don’t get to spend enough time on it. You can help me make Bad Behavior even better by making your most generous donation for any amount. (BTW, I fixed all the broken donation links, I think. If you find any other broken ones, let me know!)

Thank you again for supporting Bad Behavior development!

I’ve been asked a number of times for this, and I’m happy to announce that someone has taken it off my plate. Eric Sizemore has ported Bad Behavior to vBulletin 3.8 and 4.x.

While I haven’t been able to test the mods extensively as yet, they appear sane and usable, and are the first for vBulletin which are feature-complete and 2.2-ready.

If you’re new to Bad Behavior, you should be aware that it operates completely differently than other anti-spam measures you may already use. The biggest difference is that Bad Behavior does not analyze the content of anything posted to your forum. This is sure to surprise you at first, until you see the number of drive-by spam registrations drop off noticeably. Even so, no spam prevention technique is 100% perfect, and so you shouldn’t drop your existing spam prevention techniques until you read this.

Check out Bad Behavior’s complete documentation for more on what all the features do and how it’s done. This is especially important if you use a load balancer, cloud hosting such as Amazon EC2, or an accelerator service such as Akamai; in these cases there is additional configuration you will need to do after installing Bad Behavior.

As with all other ports, you should seek support for anything vBulletin-specific from the port maintainer, Eric (using the links provided above); as always, I continue to provide support for the Bad Behavior core, as well as the WordPress and MediaWiki ports. Welcome again, and here’s to a spam-free forum!

Please note: The 2.0 series of Bad Behavior is receiving limited updates, including unblocks, bug fixes and security fixes only. Future development is taking place in the 2.1 development tree.

Who should upgrade?

Users with a significant amount of traffic from mobile devices should upgrade to ensure that requests from older and “dumb” mobile phones are screened properly.

What’s new?

New in this release (since 2.0.41 and 2.1.10):

• Google operates a proxy server for “feature phones” (dumb mobile phones; perhaps should be called feature limited) with limited Web browsers which reformats web pages into a simpler format for viewing on such phones. While it is now rarely used, requests from this proxy server, known as Google Wireless Transcoder, were being treated as search engine requests (and denied for not being a search engine). This issue has been fixed.
• Our new bug tracking system is online. If you find a bug in Bad Behavior, please submit it there. This will help me keep track of outstanding issues and ensure that I can get them resolved in a timely manner without losing track of them in my massive inbox.

What’s coming?

I’m currently preparing to release the next major stable release of Bad Behavior, version 2.2. This release is sufficiently different that anyone maintaining a port needs to update their port to handle the new features immediately (such changes are backward compatible if implemented properly).

After that, the next development branch will target version 3.0. As I’ve mentioned before, it’s a complete ground-up rewrite, so anyone maintaining a port will need to track development and be prepared to completely rewrite their ports. It’s going to be a week or two at least before I have alpha code to share, but you will want to make time for it, because there will also be important changes in the way Bad Behavior is distributed. I hope to have 3.0 in beta within the next month, and a general release by the end of May.

For our enterprise users who require long-term support, the 2.0 branch will continue to receive long-term support through June 30, 2012, and the 2.2 branch (coming shortly) will be fully supported until the 3.0 release, and then receive long-term support through June 30, 2014.

Download

Download the latest release of Bad Behavior now!

Support

I can only spend time on improving Bad Behavior when incoming donations cover the cost of my time. Otherwise I have to engage in paying work to keep food on my table.

I happen to like giving spammers a hard time, and it’s frustrating that I don’t get to spend enough time on it. You can help me make Bad Behavior even better by making your most generous contribution for any amount. (BTW, I fixed all the broken donation links, I think. If you find any other broken ones, let me know!)

Thank you again for supporting Bad Behavior development!

Please note: The 2.0 series of Bad Behavior is receiving limited updates, including unblocks, bug fixes and security fixes only. Future development is taking place in the 2.1 development tree.

Who should upgrade?

All users should upgrade to ensure that requests from major search engines are always approved.

What’s new?

New in this release (since 2.0.40 and 2.1.9):

• The Yahoo! Slurp search engine crawler recently changed its HTTP headers, and as a result, Bad Behavior began inadvertently blocking it. So that future similar changes made by search engines do not impact you, Bad Behavior’s search engine handling has been changed so that if a request is confirmed as coming from a major search engine, all other tests are bypassed and the request is approved. Bad Behavior natively checks for Google, Microsoft and Yahoo! search engines, and when http:BL is in use, Bad Behavior can confirm several other smaller search engines. Bad Behavior will continue to block requests which falsely claim to be one of these search engines.
• The README file included with Bad Behavior has been updated.
• The copy of the GNU General Public License version 2, included with the 2.0 release of Bad Behavior, was inadvertently replaced with version 3 in the distribution. Version 2 has been re-included in the distribution. For the moment, the stable branch remains licensed under GPLv2 while the development branch has moved to LGPLv3.

Download

Download the latest release of Bad Behavior now!

Support

I can only spend time on improving Bad Behavior when incoming donations cover the cost of my time. Otherwise I have to engage in paying work to keep food on my table.

I happen to like giving spammers a hard time, and it’s frustrating that I don’t get to spend enough time on it. You can help me make Bad Behavior even better by making your most generous contribution for any amount. (BTW, I fixed all the broken donation links, I think. If you find any other broken ones, let me know!)

Thank you again for supporting Bad Behavior development!

Please note: The 2.0 series of Bad Behavior is receiving limited updates, including unblocks, bug fixes and security fixes only. Future development is taking place in the 2.1 development tree.

Who should upgrade?

All development users should upgrade to ensure that cross-site requests are screened properly and to protect against cross-site request forgery.

All development users who use a reverse proxy, load balancer, HTTP accelerator, or similar technology should upgrade to take advantage of new functionality supporting these deployments. (This includes CloudFlare. They say you’ll throw the first one away, and I certainly did.)

What’s new?

New in this release (since 2.1.8):

• [Ticket 2] Bad Behavior includes new functionality to support its use behind a reverse proxy server, load balancer, HTTP accelerator, content distribution network, and similar technologies. To implement this functionality, three new core options have been added:
  • Reverse Proxy (default false) When enabled, Bad Behavior will assume it is receiving a connection from a reverse proxy, when a specific HTTP header is received.
  • Reverse Proxy Header (default “X-Forwarded-For”) When Reverse Proxy is enabled, Bad Behavior checks this header to locate the true IP address of the connecting client.
  • Reverse Proxy Addresses (default array()) An array of IP address or CIDR netblocks which Bad Behavior trusts to provide reliable information in the HTTP header given above. If no addresses are given, Bad Behavior will assume that the HTTP header given is always trustworthy and that the right-most IP address appearing in the header is correct. If you have a chain of two or more proxies this is probably not what you want; in this scenario you should either set this option and provide all proxy server IP addresses (or ranges) which could conceivably handle the request, or have your edge servers set a unique HTTP header with the client’s IP address. For instance, when using CloudFlare, it is impossible to provide a list of IP addresses, so you would set the HTTP header to CloudFlare’s provided “CF-Connecting-IP” header instead.

  The WordPress port already contains a configuration interface for these new options. Port maintainers should add the necessary options to their own interfaces now.

• [Ticket 3] Bad Behavior provides an option to allow cross-site POST requests; these are meant to be blocked by default as most sites do not need to receive form data submitted from other sites. However, the option to enable it for those sites which do need it had inverted logic, resulting in cross-site requests being allowed when the option was set to disallow them, and vice versa. This issue has been fixed.
• Bad Behavior 2.1.9 is the first release to use the GNU Lesser General Public License version 3 (or, at your option, any later version).

What’s coming?

I’ve set up an issue tracking system so that people can report bugs more easily. It’s bare bones at the moment, but you can use it to report bugs now. In the future it will be used to hold development information and a browsable source code repository.

I’ve also set up a git repository for Bad Behavior. The first code to be checked in will be the first 3.0 alpha, which I hope to have available within the next week or so. Details on how to access the repository will come at that time.

Download

Download the latest development release of Bad Behavior now!

Support

I can only spend time on improving Bad Behavior when incoming donations cover the cost of my time. Otherwise I have to engage in paying work to keep food on my table.

I happen to like giving spammers a hard time, and it’s frustrating that I don’t get to spend enough time on it. You can help me make Bad Behavior even better by making your most generous contribution for any amount. (BTW, I fixed all the broken donation links, I think. If you find any other broken ones, let me know!)

Thank you again for supporting Bad Behavior development!

Please note: The 2.0 series of Bad Behavior is receiving limited updates, including unblocks, bug fixes and security fixes only. Future development is taking place in the 2.1 development tree.

Who should upgrade?

All development users should upgrade to ensure that web pages are indexed properly in the Bing search engine, as well as to take advantage of new functionality described below.

CloudFlare users should upgrade to ensure that their sites remain accessible when using the CloudFlare reverse proxy service.

What’s new?

New in this release (since 2.1.7):

• Microsoft has begun using a new IP address range for its msnbot search engine crawler, which provides data for the Bing search engine. This address range is now correctly recognized as belonging to Microsoft. (Reported by multiple users.)
• Round-trip DNS detection code in previous versions was failing in strange ways due in part to a long-standing bug in PHP which is still not fixed as of this writing. This affected access by search engines as well as for anyone when the site uses CloudFlare. The round-trip DNS detection code has been temporarily disabled until a workaround or fix for PHP is available.
• Due to the above issue, Bad Behavior effectively disables itself when CloudFlare use is detected. This is temporary until certain tests can be rearranged.
• A number of very small files have been consolidated into slightly larger files to reduce disk I/O. Here we are targeting the typical 4K memory page (and future 4K disk block) boundary. More such consolidation will take place in the near future.
• A small number of additional user-agents have been added to the internal blacklist and one has been modified to eliminate a potential false positive.

What’s coming?

Bad Behavior’s system requirements have been specified for the first time, at user request. Bad Behavior 2.0 requires PHP 4.3 or later, and 2.1 requires PHP 5.2 or later (5.3 when running on Windows). Both releases require MySQL 4.0 or later when using a database. I have had code contributed which offers PostgreSQL support and I will be integrating this soon. Note that as 2.1 is still the development branch, requirements may change (up or down) as development progresses.

Thanks to Dave Reid, who has provided a basic class structure for Bad Behavior, the next major release will be (mostly) object oriented while maintaining high performance and compatibility with PHP scripts which don’t make extensive use of OO. This will actually make it easier to do ports to various systems such as Drupal and enable ports to replace parts of Bad Behavior’s functionality when it makes sense for them to do so.

Future versions of Bad Behavior, beginning with the next development release, will be licensed under the GNU Lesser General Public License version 3. This licensing change will make it easier to resolve legal issues with porting to certain non-free software such as Simple Machines Forum, vBulletin, ExpressionEngine, etc. by making it unnecessary to grant specific license exemptions for such software in most cases. If you’re planning a port and still have legal issues, contact me.

Download

Download the latest development release of Bad Behavior now!

Support

I can only spend time on improving Bad Behavior when incoming donations cover the cost of my time. Otherwise I have to engage in paying work to keep food on my table.

I happen to like giving spammers a hard time, and it’s frustrating that I don’t get to spend enough time on it. You can help me make Bad Behavior even better by setting up a recurring contribution, or making your most generous one-time contribution for any amount.

Thank you again for supporting Bad Behavior development!

Please note: The 2.0 series of Bad Behavior is receiving limited updates, including unblocks, bug fixes and security fixes only. Future development is taking place in the 2.1 development tree.

Who should upgrade?

Users of the CloudFlare reverse proxy service should upgrade to ensure that blocked requests display correct, usable technical support keys.

What’s new?

New in this release (since 2.1.4):

• A code omission was causing Bad Behavior to display incorrect technical support keys to blocked requests on sites using the CloudFlare reverse proxy service. This issue has been fixed.

What’s coming?

In the next few releases I will be rolling out a significant number of blocks intended to catch a wide variety of malicious robots. These include content scrapers, referrer spammers, automated cracking tools and more. Each of these is going through an extensive review prior to being released, to ensure that legitimate requests are not blocked.

Download

Download the latest development release of Bad Behavior now!

Support

I can only spend time on improving Bad Behavior when incoming donations cover the cost of my time. Otherwise I have to engage in paying work to keep food on my table.

I happen to like giving spammers a hard time, and it’s frustrating that I don’t get to spend enough time on it. You can help me make Bad Behavior even better by setting up a recurring contribution, or making your most generous one-time contribution for any amount.

Thank you again for supporting Bad Behavior development!

Please note: The 2.0 series of Bad Behavior is receiving limited updates, including unblocks, bug fixes and security fixes only. Future development is taking place in the 2.1 development tree.

Who should upgrade?

All users should upgrade to prevent a fatal error which may cause sites to fail to load correctly.

Users of Bad Behavior who expect a significant amount of traffic from Facebook, or who use Facebook integration tools, should upgrade to ensure that these tools work correctly.

What’s new?

New in this release (since 2.1.3):

• A logic error in the CloudFlare code introduced in 2.1.3 caused installation or upgrading to fail under some circumstances, and caused a fatal error on systems which are using CloudFlare. This code has been rewritten.
• A web crawler used by Facebook was inadvertently blocked because it engages in some unusual behavior. This could cause links to protected pages to appear on Facebook without their title, photo or description. This issue with Facebook’s crawler has been worked around.

Download

Download Bad Behavior now!

Support

You’ve probably noticed that until recently there hadn’t been a release of Bad Behavior in several months. This is due entirely to the fact that I can only spend time on it when incoming donations cover the cost of my time. Otherwise I have to engage in paying work to keep food on my table.

I happen to like giving spammers a hard time, and it’s frustrating that I don’t get to spend enough time on it. You can help me make Bad Behavior even better by setting up a recurring contribution, or making your most generous one-time contribution for any amount.

Thank you again for supporting Bad Behavior development!

Please note: The 2.0 series of Bad Behavior is receiving limited updates, including unblocks, bug fixes and security fixes only. Future development is taking place in the 2.1 development tree.

Who should upgrade?

Users deploying Bad Behavior on Microsoft IIS should upgrade to ensure that all Bad Behavior functionality works as intended.

Users who receive a significant amount of traffic from proxied connections (e.g. small business and enterprise users) should upgrade to prevent a tiny minority of these users from being blocked.

Users following the development branch should upgrade to take advantage of support for the CloudFlare reverse proxy service.

What’s new?

New in the 2.0.37 stable release (since 2.0.36):

• In rare configurations, the Firefox and Safari web browsers may send the nonexistent “Proxy-Connection” HTTP header. Old versions of Internet Explorer may also send this header in their default configurations. This usually occurs when the web browser is configured to connect to an (obsolete) HTTP/1.0 proxy or has been explicitly configured to use HTTP/1.0 when talking to a proxy, even if the proxy understands HTTP/1.1. This header originated with a proposal made by (then) Netscape which was rejected for inclusion in HTTP in 1998 due to its causing interoperability problems. Bad Behavior checks for this header as it has historically made an excellent indicator of malicious activity if it is seen at the origin server, because proxy servers are expected to strip the header. Because of the slight possibility of blocking legitimate users, this check is now active only in strict mode. (Thanks to Mark Nottingham for reporting this issue.)
• A workaround for a problem with PHP on IIS servers has been implemented. This issue caused various parts of Bad Behavior’s functionality to fail on IIS. (Thanks to Michael Kingery for reporting this issue.)

New in the 2.1.3 development release (since 2.1.2):

• The changes listed above for 2.0.37 have also been implemented.
• New code which implements “round-trip DNS” for verifying that an IP address belongs to a specific entity is now being used to verify Googlebot and MSNbot. This code replaces the old hard-coded IP addresses.
• Support for the CloudFlare reverse proxy service has been added. Users of this service should now be able to use Bad Behavior successfully. (Thanks to Matthew Prince at Project Honey Pot for his assistance with this implementation.)

Download

Download Bad Behavior now!

The 2.1 development releases will not be offered through the WordPress automatic upgrade facility. Only stable releases will be offered through automatic upgrade.

Support

You’ve probably noticed that there hasn’t been a release of Bad Behavior in several months. This is due entirely to the fact that I can only spend time on it when incoming donations cover the cost of my time. Otherwise I have to engage in paying work to keep food on my table.

I happen to like giving spammers a hard time, and it’s frustrating that I don’t get to spend enough time on it. You can help me make Bad Behavior even better by setting up a recurring contribution, or making your most generous one-time contribution for any amount.

Thank you again for supporting Bad Behavior development!

Please note: The 2.0 series of Bad Behavior is receiving limited updates, including unblocks, bug fixes and security fixes only. Future development is taking place in the 2.1 development tree.

Who should upgrade?

Users who use the new URL whitelisting feature should upgrade to ensure that whitelisting works correctly in all circumstances.

What’s new?

New in this release (since 2.1.1):

• A logic error in the URL whitelisting feature caused URLs to fail to match the whitelist if the if the web browser requested a URL containing a ? character. This issue has been fixed.

Download

The 2.1 development releases will not be offered through the WordPress automatic upgrade facility.

Download the 2.1.2 development release of Bad Behavior now!

Support

This release would not have been possible without the support of people like you who find Bad Behavior valuable enough to make a financial contribution to ensure its further development.

Your contributions ensure that I can continue to devote time to bringing you the features you want, as well as continuing work on making spammers’ lives hell.

If you haven’t already done so, consider setting up a recurring contribution for as little as $5 per year, or make your most generous one-time contribution for any amount.

Thank you again for supporting Bad Behavior development!