Comments on: Bad Behavior 2.1.1 and 2.0.36 Security Release

By: Bad Behavior / Bad Behaviour: Bad Behavior 2.0.37 and 2.1.3

Bad Behavior / Bad Behaviour: Bad Behavior 2.0.37 and 2.1.3 — Fri, 09 Jul 2010 05:18:02 +0000

[...] New in the 2.0.37 stable release (since 2.0.36): [...]

By: Chris

Chris — Tue, 29 Jun 2010 15:59:10 +0000

Aha. I didn’t see the link to “Activate Bad Behavior Site Wide”. Sorry if I wasted your time.

By: Michael Hampton

Michael Hampton — Mon, 28 Jun 2010 17:39:49 +0000

Chris, WordPress MU (now WordPress 3.0) has changed significantly since that forum post. I now recommend you install it in plugins, and activate it site-wide (or just make it available for individual blogs) from the site admin plugins page.

By: Chris

Chris — Wed, 23 Jun 2010 11:40:21 +0000

Michael

I’m having trouble getting Bad Behavior to work with WordPress MU. Elsewhere you say that Bad Behavior should work if it is placed in mu-plugins or plugins. How can I tell if it is working?

If I place it in the plugins directory, it needs to be enabled on a blog-by-blog basis, which isn’t ideal.

If I place it in mu-plugins, there’s no indication that it is working (i.e. the statistics don’t show up in the footer, presumably because the setup routines aren’t triggered).

Can I put something in my UA string that will trigger BB2?

Thanks in advance.

By: Michael Hampton

Michael Hampton — Mon, 31 May 2010 12:55:18 +0000

Bad Behavior checks every crawler claiming to be Googlebot, Yahoo! or MSN/Live/Bing/whatever they rename it to next week. Legitimate ones pass, while fake ones are blocked. Unfortunately some people go through their logs, see a request from “Googlebot” was blocked, and didn’t bother to check to see if it was the real Googlebot before they blogged about it. You can be sure that requests coming from a home cable ISP network are not from Google.

By: Luke

Luke — Mon, 31 May 2010 11:54:49 +0000

Thanks Alvaro. Looking forward to not getting shafted by link spammers! Our send to a friend forms have been taking a hammering and our domain has landed up on email blacklists as a result.

By: LeetPirate

LeetPirate — Mon, 31 May 2010 11:30:24 +0000

I just wish somebody would make an updated extension for Joomla.

By: Álvaro Degives-Más

Álvaro Degives-Más — Mon, 31 May 2010 11:27:41 +0000

Sorry – forgot the punchline. I have Bad Behavior on strict mode running for two years in a row, and we’ve “only” reaped massive benefits from that. Why? Because Google et al give extra cuddles to sites without a shred of spam or malware injected into them, and badly punishes those that are infected. Here’s the key analogy for you: openness to exposure and infection rate are proportionally linked phenomena.

By: Álvaro Degives-Más

Álvaro Degives-Más — Mon, 31 May 2010 11:21:20 +0000

Luke, Google uses servers that are identifiable in a known manner. The fake ones don’t pass the “secret handshake” test. Of course, those who thrive on / use / propagate / developed a Stockholm Syndrome affinity for bad bots all claim loudly and colorfully that they are really, honest to Bob, the legit ones who are suffering a great injustice by getting the boot in the face.

Trust me: the real Google, Yahoo and Bing bots have no problem. Bad bots who try to pass themselves off as any (or all) of them, do not. Neither do idiots reporting all over the world wide web that “legitimate Googlebots were blocked” by Bad Behavior. They lie, they’re misinformed, or they’re just sloppy; take your pick, they’re still wrong nonetheless.

By: Luke

Luke — Mon, 31 May 2010 10:22:38 +0000

How can I confirm that Bad Behavior has not affected Googlebot accessing my site? I have seen many reports that it either blocks or hampers Googlebot. It is business critical for us that we are crawled. I’m not saying there is a problem, I’d just like to be sure and I’m asking if there is a test you might recommend to confirm we will continue to be crawled as per normal.

Thanks