Bad Behaviour Probing

We are currently reviewing the settings for BadBehaviour 3.0 and the associated admin panel module.



So if you are blocked or the website is unavailable, please try again later.


┌─────────────────────────────────────────────────────────────┐
│  USER LAYER                                                 │
│    Preset choice + 3-5 visible toggles                      │
│    The only thing 99% of users ever touch                   │
├─────────────────────────────────────────────────────────────┤
│  FALSE POSITIVE GUARDRAILS  ◄── biggest concern             │
│    Conservative defaults                                    │
│    Negative caches                                          │
│    Soft timeouts                                            │
│    "When in doubt, allow" philosophy                        │
├─────────────────────────────────────────────────────────────┤
│  INTERNAL DNS INFRASTRUCTURE                                │
│    Sync verification                                        │
│    Async range feeds                                        │
│    On-demand refresh                                        │
│    Snapshot fallback                                        │
│    Hidden behind presets, never seen by users               │
└─────────────────────────────────────────────────────────────┘

                ┌─────────────────┐
  request ───▶ │  BadBehaviour   │
                │  ::run()        │
                └────────┬────────┘
                         │
                         ▼
                ┌─────────────────┐
                │  RequestPackage │  ← parse $_SERVER + headers
                │  (immutable)    │
                └────────┬────────┘
                         │
                         ▼
        ┌────────────────────────────────────┐
        │   Detection pipeline (ordered)     │
        │                                    │
        │  1. Whitelist check        → ALLOW │
        │  2. Custom rules           → ?     │
        │  3. BotDetector            → ?     │   ← UA + IP + DNS
        │  4. HeadRequestDetector    → ?     │     verification
        │  5. ClientHintsDetector    → ?     │     (~100 bot
        │  6. BlacklistDetector      → ?     │     categories)
        │  7. AssetScrapingDetector  → ?     │
        │  8. BehavioralDetector     → ?     │
        │  9. AgenticBehaviorDetector→ ?     │
        │  10. RateLimitDetector     → ?     │
        │  11. DnsblDetector         → ?     │
        │  12. FingerprintDetector   → ?     │
        └────────────┬───────────────────────┘
                     │
                     ▼
        ┌────────────────────────────┐
        │ maybe_demote_to_monitored()│   ← monitor-only mode converts
        └────────────┬───────────────┘     "would have blocked" to
                     │                     "monitored" (no 403 served)
                     ▼
        ┌────────────────────────────┐
        │ log_request()              │   ← writes to bad_behaviour
        │  + return Result           │     with enforcement_action
        └────────────────────────────┘     (enforced|monitored|allowed)

We are working to reduce false positives. We welcome your feedback.


Technical anomaly in URL (valid block)

Comments