@A9x6Uv (for above contribution) and @thecoalman (for many contributions in this and other threads on this topic)
It's more appropriate to respond to this thread than the other similar topics. I too was having the bot flooding issue for the last several months but the last week saw it kill my site such that I couldn't consistently view pages or log in so I was forced to do something. I'm not an expert in this area, didn't have the time right now to go up the learning curve, and I was intimidated to make server side changes to sensitive things I didn't fully understand.
I went with Cloudflare (CF). It's user interface is superb, I followed the step-by-step instructions, and it transferred the DNS records and updated the Nameservers flawlessly. For the record I have a small site that runs phpBB forums (v3.3.2) as part of the site, I'm on a shared IP hosting package, and I'm using the free CF tier.
Part of the reason I'm writing is that I ran into a situation that I also saw mentioned in another thread. After converting to using CF all of a sudden I was having inexplicable and somewhat random issues staying logged in. I hadn't made any ACP changes and, in particular, my unattended Admin login only lasted 30 secs. Checking the Remember Me login box seemed to cure the problem but in my mind that was more than likely hiding the real issue.
My ACP default "Session IP validation" was set to "A.B.C". When I changed this to "A.B" session login's seem to be working perfectly again. It seems reasonable to me that CF may be adjusting IP addresses to my site and, thus, the issue I was having.
Another potential interaction you might want to be aware of is the CF Security->Settings->Challenge Passage setting which is a control you set for re-challenge.
I still have to play with other bot settings but this approach so far has been gold for me.
It's more appropriate to respond to this thread than the other similar topics. I too was having the bot flooding issue for the last several months but the last week saw it kill my site such that I couldn't consistently view pages or log in so I was forced to do something. I'm not an expert in this area, didn't have the time right now to go up the learning curve, and I was intimidated to make server side changes to sensitive things I didn't fully understand.
I went with Cloudflare (CF). It's user interface is superb, I followed the step-by-step instructions, and it transferred the DNS records and updated the Nameservers flawlessly. For the record I have a small site that runs phpBB forums (v3.3.2) as part of the site, I'm on a shared IP hosting package, and I'm using the free CF tier.
Part of the reason I'm writing is that I ran into a situation that I also saw mentioned in another thread. After converting to using CF all of a sudden I was having inexplicable and somewhat random issues staying logged in. I hadn't made any ACP changes and, in particular, my unattended Admin login only lasted 30 secs. Checking the Remember Me login box seemed to cure the problem but in my mind that was more than likely hiding the real issue.
My ACP default "Session IP validation" was set to "A.B.C". When I changed this to "A.B" session login's seem to be working perfectly again. It seems reasonable to me that CF may be adjusting IP addresses to my site and, thus, the issue I was having.
Another potential interaction you might want to be aware of is the CF Security->Settings->Challenge Passage setting which is a control you set for re-challenge.
I still have to play with other bot settings but this approach so far has been gold for me.
Statistics: Posted by mtn — Mon Jun 16, 2025 7:54 pm