Bad Behavior 2.2.20 has been released. This is a maintenance release and is recommended for all users.

Changes

The following changes have been made since 2.2.19:

• A spurious PHP notice was removed. Fixes issue 121.
• The current use of cookies to screen requests is being deprecated. Any cookies will be removed from users’ browsers, if they exist. Fixes issue 131.

Download

Download Bad Behavior now.

Notes

Just as a reminder, if you use CloudFlare on your site, you must enable the Reverse Proxy option in Bad Behavior’s settings, or many of your visitors and search engines will be blocked.

Bad Behavior 2.2.19 has been released. This is a security release affecting WordPress users, who should update as soon as possible.

Changes

The following changes have been made since 2.2.18:

• WordPress: In certain circumstances, a cross-site scripting attack was possible via the Bad Behavior Whitelist options page. This issue has been fixed.
• WordPress: Protection from cross-site request forgery (WordPress nonces) has been added to the Bad Behavior Whitelist and Bad Behavior Options pages. This covers cases where Bad Behavior’s built-in CSRF protection is disabled or ineffective.

These issues were reported by Plugin Vulnerabilities.

Download

Download Bad Behavior now.

Notes

Just as a reminder, if you use CloudFlare on your site, you must enable the Reverse Proxy option in Bad Behavior’s settings, or many of your visitors and search engines will be blocked.

Bad Behavior 2.2.18 has been released. This is a maintenance release and is recommended for all users.

Changes

The following changes have been made since 2.2.17:

• A new IP address range is in use by the Bing search engine; this range has been added to Bad Behavior.

Download

Download Bad Behavior now.

Notes

Just as a reminder, if you use CloudFlare on your site, you must enable the Reverse Proxy option in Bad Behavior’s settings, or many of your visitors and search engines will be blocked.

Bad Behavior 2.2.17 has been released. This is a maintenance release and is recommended for all users.

Changes

The following changes have been made since 2.2.16:

• Bad Behavior is now compatible with PHP 7.
• WordPress: Bad Behavior is now compatible with WordPress 4.4.
• Bad Behavior can now be used on sites which run on a non-standard HTTP port (the standard ports are 80 for HTTP and 443 for HTTPS).

Download

Download Bad Behavior now.

Notes

Just as a reminder, if you use CloudFlare on your site, you must enable the Reverse Proxy option in Bad Behavior’s settings, or many of your visitors and search engines will be blocked.

Bad Behavior 2.2.16 has been released. This is a maintenance release and is recommended for all users.

Changes

The following changes have been made since 2.2.15:

• The via HTTP header, when present in all lowercase letters, violates a convention that headers should be in mixed case, and the lowercase-only header is commonly seen from malicious proxy servers. However, the actual HTTP specifications do not disallow it, and a check for this lowercase header does block some legitimate traffic. Therefore this version of Bad Behavior has been changed to check for lowercase via only in strict mode. This resolves an issue where web users at certain large companies are blocked; sites expecting these visitors should not enable strict mode.

Download

Download Bad Behavior now.

Notes

Just as a reminder, if you use CloudFlare on your site, you must enable the Reverse Proxy option in Bad Behavior’s settings, or many of your visitors and search engines will be blocked.

Bad Behavior 2.2.15 has been released. This is a maintenance release and is recommended for all users.

Changes

The following changes have been made since 2.2.14:

• An additional exploit scanner has been identified and blocked.
• Issue #66: WordPress: A deprecated function has been removed and replaced.
• Issue #72: Recent versions of the Google Chrome and Firefox browsers do not actually delete session cookies by default when closing the browser. This resulted in a rare case where old session cookies, served when the site’s EU Cookie setting was off, would be returned if the EU Cookie setting was later enabled. When this happened, the visitor would be blocked. This issue is now resolved.

Download

Download Bad Behavior now.

Notes

Just as a reminder, if you use CloudFlare on your site, you must enable the Reverse Proxy option in Bad Behavior’s settings, or many of your visitors and search engines will be blocked.

As you are probably aware, Microsoft will finally end all support for Windows XP on April 8, 2014, nearly 13 years after the operating system was first released. While mainstream support for Windows XP and Server 2003 ended back in 2010, these OSes have been on extended life support since then.

(Windows Server 2003 and Server 2003 R2 reach end of life on July 14, 2015.)

It was a hell of a ride. Nearly everyone who has ever touched a computer has gotten to know Windows XP, with all its faults, and some people even grew to love it. But as with all things in computing, the time eventually comes to move on. Continue reading →

Bad Behavior 2.2.14 has been released. This is a maintenance release and is recommended for all users.

Changes

The following changes have been made since 2.2.13:

• An additional exploit scanner has been identified and blocked.
• A small change has been made to accommodate a change made by Firefox to its User-Agent format, to ensure that Firefox 25 (which doesn’t yet exist) is not improperly blocked.

Download

Download Bad Behavior now.

Notes

Just as a reminder, if you use CloudFlare on your site, you must enable the Reverse Proxy option in Bad Behavior’s settings, or many of your visitors and search engines will be blocked.

Work on Bad Behavior 3.0 is making progress; I have some very basic pre-alpha code and a test framework and I hope to have it cleaned up enough to attempt to begin using in the next few days. If you would like to see this work progress more quickly, or you just want to say thank you, consider making a donation today.

I had to temporarily block all user registrations on the bug tracker for a short while due, ironically, to spam registrations.

Registration has been reopened for now, and I’m manually dealing with the spammers.

This very bad experience has motivated me to do more about web spammers.

In this case, the bug tracker is Redmine, a web application developed in Ruby on Rails.

My first thought in such a case would have been to throw Bad Behavior at the web app and let it handle the problem. Unfortunately, Bad Behavior is written in PHP, making this impossible. By this point there must be any number of Ruby/Rails apps out there which are now suffering from the spam problems that we all went through and mostly got under control years ago.

It’s therefore my intention, as part of the Bad Behavior 3.0 rewrite, to create a Ruby gem which can be used to help secure such web applications. It may not be a simultaneous release, but something has to be done, and soon.

P.S. It’s also come to my attention that Redmine hasn’t been emailing me when someone enters a new ticket into the system. This should also be fixed. I’ve also taken the time to look at every ticket currently in the system. All bugs and support requests have been responded to, and all features looked at.